{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1cd96ac4-97f0-46e3-93bb-2b0a9aa1bc7f","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"1cd96ac4-97f0-46e3-93bb-2b0a9aa1bc7f"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"1cd96ac4-97f0-46e3-93bb-2b0a9aa1bc7f","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":553554136,"seconds":1783435534},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:41430","port":41430}}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1cd96ac4-97f0-46e3-93bb-2b0a9aa1bc7f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1cd96ac4-97f0-46e3-93bb-2b0a9aa1bc7f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1cd96ac4-97f0-46e3-93bb-2b0a9aa1bc7f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"1cd96ac4-97f0-46e3-93bb-2b0a9aa1bc7f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1cd96ac4-97f0-46e3-93bb-2b0a9aa1bc7f","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1cd96ac4-97f0-46e3-93bb-2b0a9aa1bc7f","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1cd96ac4-97f0-46e3-93bb-2b0a9aa1bc7f","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1cd96ac4-97f0-46e3-93bb-2b0a9aa1bc7f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1cd96ac4-97f0-46e3-93bb-2b0a9aa1bc7f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"795d6d46-9223-46fd-a933-033c162165f8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41444","PortSpecifier":{"PortValue":41444}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"795d6d46-9223-46fd-a933-033c162165f8","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"795d6d46-9223-46fd-a933-033c162165f8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41444","PortSpecifier":{"PortValue":41444}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435534,"nanos":604405838},"http":{"id":"795d6d46-9223-46fd-a933-033c162165f8","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"795d6d46-9223-46fd-a933-033c162165f8","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"795d6d46-9223-46fd-a933-033c162165f8","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"795d6d46-9223-46fd-a933-033c162165f8","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"795d6d46-9223-46fd-a933-033c162165f8"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"795d6d46-9223-46fd-a933-033c162165f8","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":604405838,"seconds":1783435534},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:41444","port":41444}}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"795d6d46-9223-46fd-a933-033c162165f8","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"795d6d46-9223-46fd-a933-033c162165f8","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"795d6d46-9223-46fd-a933-033c162165f8","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"795d6d46-9223-46fd-a933-033c162165f8","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"795d6d46-9223-46fd-a933-033c162165f8","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"795d6d46-9223-46fd-a933-033c162165f8","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"795d6d46-9223-46fd-a933-033c162165f8","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"795d6d46-9223-46fd-a933-033c162165f8","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"795d6d46-9223-46fd-a933-033c162165f8","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"88b69acf-abe3-47d6-abb9-38172511cb05","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41452","PortSpecifier":{"PortValue":41452}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"88b69acf-abe3-47d6-abb9-38172511cb05","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"88b69acf-abe3-47d6-abb9-38172511cb05","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41452","PortSpecifier":{"PortValue":41452}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435534,"nanos":654162249},"http":{"id":"88b69acf-abe3-47d6-abb9-38172511cb05","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"88b69acf-abe3-47d6-abb9-38172511cb05","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"88b69acf-abe3-47d6-abb9-38172511cb05","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"88b69acf-abe3-47d6-abb9-38172511cb05","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"88b69acf-abe3-47d6-abb9-38172511cb05"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"88b69acf-abe3-47d6-abb9-38172511cb05","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":654162249,"seconds":1783435534},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:41452","port":41452}}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"88b69acf-abe3-47d6-abb9-38172511cb05","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"88b69acf-abe3-47d6-abb9-38172511cb05","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"88b69acf-abe3-47d6-abb9-38172511cb05","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"88b69acf-abe3-47d6-abb9-38172511cb05","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"88b69acf-abe3-47d6-abb9-38172511cb05","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"88b69acf-abe3-47d6-abb9-38172511cb05","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"88b69acf-abe3-47d6-abb9-38172511cb05","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"88b69acf-abe3-47d6-abb9-38172511cb05","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"88b69acf-abe3-47d6-abb9-38172511cb05","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"73a11df4-db51-4031-8491-d8d6914121d2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41466","PortSpecifier":{"PortValue":41466}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"73a11df4-db51-4031-8491-d8d6914121d2","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"73a11df4-db51-4031-8491-d8d6914121d2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41466","PortSpecifier":{"PortValue":41466}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435534,"nanos":704286309},"http":{"id":"73a11df4-db51-4031-8491-d8d6914121d2","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"73a11df4-db51-4031-8491-d8d6914121d2","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"73a11df4-db51-4031-8491-d8d6914121d2","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"73a11df4-db51-4031-8491-d8d6914121d2","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"73a11df4-db51-4031-8491-d8d6914121d2"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"73a11df4-db51-4031-8491-d8d6914121d2","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":704286309,"seconds":1783435534},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:41466","port":41466}}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"73a11df4-db51-4031-8491-d8d6914121d2","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"73a11df4-db51-4031-8491-d8d6914121d2","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"73a11df4-db51-4031-8491-d8d6914121d2","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"73a11df4-db51-4031-8491-d8d6914121d2","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"73a11df4-db51-4031-8491-d8d6914121d2","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"73a11df4-db51-4031-8491-d8d6914121d2","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"73a11df4-db51-4031-8491-d8d6914121d2","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"73a11df4-db51-4031-8491-d8d6914121d2","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"73a11df4-db51-4031-8491-d8d6914121d2","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5cf23941-43ba-40d5-b7ff-4d0d62394d42","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41468","PortSpecifier":{"PortValue":41468}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5cf23941-43ba-40d5-b7ff-4d0d62394d42","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5cf23941-43ba-40d5-b7ff-4d0d62394d42","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41468","PortSpecifier":{"PortValue":41468}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435534,"nanos":754024876},"http":{"id":"5cf23941-43ba-40d5-b7ff-4d0d62394d42","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"5cf23941-43ba-40d5-b7ff-4d0d62394d42","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5cf23941-43ba-40d5-b7ff-4d0d62394d42","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5cf23941-43ba-40d5-b7ff-4d0d62394d42","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"5cf23941-43ba-40d5-b7ff-4d0d62394d42"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"5cf23941-43ba-40d5-b7ff-4d0d62394d42","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":754024876,"seconds":1783435534},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:41468","port":41468}}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5cf23941-43ba-40d5-b7ff-4d0d62394d42","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5cf23941-43ba-40d5-b7ff-4d0d62394d42","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5cf23941-43ba-40d5-b7ff-4d0d62394d42","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"5cf23941-43ba-40d5-b7ff-4d0d62394d42","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5cf23941-43ba-40d5-b7ff-4d0d62394d42","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5cf23941-43ba-40d5-b7ff-4d0d62394d42","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5cf23941-43ba-40d5-b7ff-4d0d62394d42","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5cf23941-43ba-40d5-b7ff-4d0d62394d42","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5cf23941-43ba-40d5-b7ff-4d0d62394d42","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a7df3b6c-5df4-467a-ac8a-478719ff2980","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41476","PortSpecifier":{"PortValue":41476}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a7df3b6c-5df4-467a-ac8a-478719ff2980","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a7df3b6c-5df4-467a-ac8a-478719ff2980","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41476","PortSpecifier":{"PortValue":41476}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435534,"nanos":803855766},"http":{"id":"a7df3b6c-5df4-467a-ac8a-478719ff2980","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"a7df3b6c-5df4-467a-ac8a-478719ff2980","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a7df3b6c-5df4-467a-ac8a-478719ff2980","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a7df3b6c-5df4-467a-ac8a-478719ff2980","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"a7df3b6c-5df4-467a-ac8a-478719ff2980"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"a7df3b6c-5df4-467a-ac8a-478719ff2980","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":803855766,"seconds":1783435534},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:41476","port":41476}}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a7df3b6c-5df4-467a-ac8a-478719ff2980","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a7df3b6c-5df4-467a-ac8a-478719ff2980","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a7df3b6c-5df4-467a-ac8a-478719ff2980","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"a7df3b6c-5df4-467a-ac8a-478719ff2980","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a7df3b6c-5df4-467a-ac8a-478719ff2980","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a7df3b6c-5df4-467a-ac8a-478719ff2980","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a7df3b6c-5df4-467a-ac8a-478719ff2980","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a7df3b6c-5df4-467a-ac8a-478719ff2980","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a7df3b6c-5df4-467a-ac8a-478719ff2980","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"894a6dca-6937-400e-9abe-adbf0113f1c8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41488","PortSpecifier":{"PortValue":41488}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"894a6dca-6937-400e-9abe-adbf0113f1c8","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"894a6dca-6937-400e-9abe-adbf0113f1c8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41488","PortSpecifier":{"PortValue":41488}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435534,"nanos":854287064},"http":{"id":"894a6dca-6937-400e-9abe-adbf0113f1c8","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"894a6dca-6937-400e-9abe-adbf0113f1c8","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"894a6dca-6937-400e-9abe-adbf0113f1c8","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"894a6dca-6937-400e-9abe-adbf0113f1c8","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"894a6dca-6937-400e-9abe-adbf0113f1c8"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"894a6dca-6937-400e-9abe-adbf0113f1c8","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":854287064,"seconds":1783435534},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:41488","port":41488}}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"894a6dca-6937-400e-9abe-adbf0113f1c8","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"894a6dca-6937-400e-9abe-adbf0113f1c8","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"894a6dca-6937-400e-9abe-adbf0113f1c8","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"894a6dca-6937-400e-9abe-adbf0113f1c8","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"894a6dca-6937-400e-9abe-adbf0113f1c8","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"894a6dca-6937-400e-9abe-adbf0113f1c8","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"894a6dca-6937-400e-9abe-adbf0113f1c8","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"894a6dca-6937-400e-9abe-adbf0113f1c8","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"894a6dca-6937-400e-9abe-adbf0113f1c8","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b98172ed-e212-46a1-b03d-e698fb87dec5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41492","PortSpecifier":{"PortValue":41492}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b98172ed-e212-46a1-b03d-e698fb87dec5","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b98172ed-e212-46a1-b03d-e698fb87dec5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41492","PortSpecifier":{"PortValue":41492}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435534,"nanos":904578421},"http":{"id":"b98172ed-e212-46a1-b03d-e698fb87dec5","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"b98172ed-e212-46a1-b03d-e698fb87dec5","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b98172ed-e212-46a1-b03d-e698fb87dec5","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b98172ed-e212-46a1-b03d-e698fb87dec5","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"b98172ed-e212-46a1-b03d-e698fb87dec5"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"b98172ed-e212-46a1-b03d-e698fb87dec5","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":904578421,"seconds":1783435534},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:41492","port":41492}}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b98172ed-e212-46a1-b03d-e698fb87dec5","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b98172ed-e212-46a1-b03d-e698fb87dec5","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b98172ed-e212-46a1-b03d-e698fb87dec5","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"b98172ed-e212-46a1-b03d-e698fb87dec5","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b98172ed-e212-46a1-b03d-e698fb87dec5","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b98172ed-e212-46a1-b03d-e698fb87dec5","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b98172ed-e212-46a1-b03d-e698fb87dec5","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b98172ed-e212-46a1-b03d-e698fb87dec5","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b98172ed-e212-46a1-b03d-e698fb87dec5","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a6ebcf5d-c636-4305-896f-c84cfba4528f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41494","PortSpecifier":{"PortValue":41494}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a6ebcf5d-c636-4305-896f-c84cfba4528f","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a6ebcf5d-c636-4305-896f-c84cfba4528f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41494","PortSpecifier":{"PortValue":41494}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435534,"nanos":954175246},"http":{"id":"a6ebcf5d-c636-4305-896f-c84cfba4528f","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"a6ebcf5d-c636-4305-896f-c84cfba4528f","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a6ebcf5d-c636-4305-896f-c84cfba4528f","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a6ebcf5d-c636-4305-896f-c84cfba4528f","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"a6ebcf5d-c636-4305-896f-c84cfba4528f"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"a6ebcf5d-c636-4305-896f-c84cfba4528f","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":954175246,"seconds":1783435534},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:41494","port":41494}}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a6ebcf5d-c636-4305-896f-c84cfba4528f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a6ebcf5d-c636-4305-896f-c84cfba4528f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a6ebcf5d-c636-4305-896f-c84cfba4528f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"a6ebcf5d-c636-4305-896f-c84cfba4528f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a6ebcf5d-c636-4305-896f-c84cfba4528f","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a6ebcf5d-c636-4305-896f-c84cfba4528f","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a6ebcf5d-c636-4305-896f-c84cfba4528f","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a6ebcf5d-c636-4305-896f-c84cfba4528f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a6ebcf5d-c636-4305-896f-c84cfba4528f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a90f8741-fe79-4946-b9c4-831d3bd9e140","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41500","PortSpecifier":{"PortValue":41500}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a90f8741-fe79-4946-b9c4-831d3bd9e140","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a90f8741-fe79-4946-b9c4-831d3bd9e140","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41500","PortSpecifier":{"PortValue":41500}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435535,"nanos":4365380},"http":{"id":"a90f8741-fe79-4946-b9c4-831d3bd9e140","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"a90f8741-fe79-4946-b9c4-831d3bd9e140","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a90f8741-fe79-4946-b9c4-831d3bd9e140","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a90f8741-fe79-4946-b9c4-831d3bd9e140","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"a90f8741-fe79-4946-b9c4-831d3bd9e140"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"a90f8741-fe79-4946-b9c4-831d3bd9e140","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":4365380,"seconds":1783435535},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:41500","port":41500}}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a90f8741-fe79-4946-b9c4-831d3bd9e140","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a90f8741-fe79-4946-b9c4-831d3bd9e140","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a90f8741-fe79-4946-b9c4-831d3bd9e140","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"a90f8741-fe79-4946-b9c4-831d3bd9e140","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a90f8741-fe79-4946-b9c4-831d3bd9e140","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a90f8741-fe79-4946-b9c4-831d3bd9e140","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a90f8741-fe79-4946-b9c4-831d3bd9e140","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a90f8741-fe79-4946-b9c4-831d3bd9e140","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a90f8741-fe79-4946-b9c4-831d3bd9e140","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"33f3f3bb-61bd-4e7b-b221-611ccd3ec08c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41510","PortSpecifier":{"PortValue":41510}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"33f3f3bb-61bd-4e7b-b221-611ccd3ec08c","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"33f3f3bb-61bd-4e7b-b221-611ccd3ec08c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41510","PortSpecifier":{"PortValue":41510}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435535,"nanos":54319674},"http":{"id":"33f3f3bb-61bd-4e7b-b221-611ccd3ec08c","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"33f3f3bb-61bd-4e7b-b221-611ccd3ec08c","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"33f3f3bb-61bd-4e7b-b221-611ccd3ec08c","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"33f3f3bb-61bd-4e7b-b221-611ccd3ec08c","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"33f3f3bb-61bd-4e7b-b221-611ccd3ec08c"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"33f3f3bb-61bd-4e7b-b221-611ccd3ec08c","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":54319674,"seconds":1783435535},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:41510","port":41510}}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"33f3f3bb-61bd-4e7b-b221-611ccd3ec08c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"33f3f3bb-61bd-4e7b-b221-611ccd3ec08c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"33f3f3bb-61bd-4e7b-b221-611ccd3ec08c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"33f3f3bb-61bd-4e7b-b221-611ccd3ec08c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"33f3f3bb-61bd-4e7b-b221-611ccd3ec08c","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"33f3f3bb-61bd-4e7b-b221-611ccd3ec08c","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"33f3f3bb-61bd-4e7b-b221-611ccd3ec08c","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"33f3f3bb-61bd-4e7b-b221-611ccd3ec08c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"33f3f3bb-61bd-4e7b-b221-611ccd3ec08c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6251f8d4-485d-4764-b08c-32b050286ea1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41524","PortSpecifier":{"PortValue":41524}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6251f8d4-485d-4764-b08c-32b050286ea1","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6251f8d4-485d-4764-b08c-32b050286ea1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41524","PortSpecifier":{"PortValue":41524}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435535,"nanos":103350235},"http":{"id":"6251f8d4-485d-4764-b08c-32b050286ea1","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"6251f8d4-485d-4764-b08c-32b050286ea1","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6251f8d4-485d-4764-b08c-32b050286ea1","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6251f8d4-485d-4764-b08c-32b050286ea1","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"6251f8d4-485d-4764-b08c-32b050286ea1"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"6251f8d4-485d-4764-b08c-32b050286ea1","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":103350235,"seconds":1783435535},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:41524","port":41524}}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6251f8d4-485d-4764-b08c-32b050286ea1","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6251f8d4-485d-4764-b08c-32b050286ea1","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6251f8d4-485d-4764-b08c-32b050286ea1","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"6251f8d4-485d-4764-b08c-32b050286ea1","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6251f8d4-485d-4764-b08c-32b050286ea1","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6251f8d4-485d-4764-b08c-32b050286ea1","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6251f8d4-485d-4764-b08c-32b050286ea1","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6251f8d4-485d-4764-b08c-32b050286ea1","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6251f8d4-485d-4764-b08c-32b050286ea1","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f5392aa3-5b63-4d61-aa06-e0423a8e02ab","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41530","PortSpecifier":{"PortValue":41530}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f5392aa3-5b63-4d61-aa06-e0423a8e02ab","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f5392aa3-5b63-4d61-aa06-e0423a8e02ab","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41530","PortSpecifier":{"PortValue":41530}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435535,"nanos":153465072},"http":{"id":"f5392aa3-5b63-4d61-aa06-e0423a8e02ab","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"f5392aa3-5b63-4d61-aa06-e0423a8e02ab","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f5392aa3-5b63-4d61-aa06-e0423a8e02ab","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f5392aa3-5b63-4d61-aa06-e0423a8e02ab","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"f5392aa3-5b63-4d61-aa06-e0423a8e02ab"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"f5392aa3-5b63-4d61-aa06-e0423a8e02ab","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":153465072,"seconds":1783435535},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:41530","port":41530}}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f5392aa3-5b63-4d61-aa06-e0423a8e02ab","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f5392aa3-5b63-4d61-aa06-e0423a8e02ab","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f5392aa3-5b63-4d61-aa06-e0423a8e02ab","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"f5392aa3-5b63-4d61-aa06-e0423a8e02ab","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f5392aa3-5b63-4d61-aa06-e0423a8e02ab","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f5392aa3-5b63-4d61-aa06-e0423a8e02ab","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f5392aa3-5b63-4d61-aa06-e0423a8e02ab","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f5392aa3-5b63-4d61-aa06-e0423a8e02ab","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f5392aa3-5b63-4d61-aa06-e0423a8e02ab","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1e3f5698-f962-4f55-82ce-656aedc55633","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41544","PortSpecifier":{"PortValue":41544}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1e3f5698-f962-4f55-82ce-656aedc55633","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1e3f5698-f962-4f55-82ce-656aedc55633","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41544","PortSpecifier":{"PortValue":41544}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435535,"nanos":204233633},"http":{"id":"1e3f5698-f962-4f55-82ce-656aedc55633","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"1e3f5698-f962-4f55-82ce-656aedc55633","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1e3f5698-f962-4f55-82ce-656aedc55633","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1e3f5698-f962-4f55-82ce-656aedc55633","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"1e3f5698-f962-4f55-82ce-656aedc55633"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"1e3f5698-f962-4f55-82ce-656aedc55633","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":204233633,"seconds":1783435535},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:41544","port":41544}}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1e3f5698-f962-4f55-82ce-656aedc55633","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1e3f5698-f962-4f55-82ce-656aedc55633","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1e3f5698-f962-4f55-82ce-656aedc55633","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"1e3f5698-f962-4f55-82ce-656aedc55633","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1e3f5698-f962-4f55-82ce-656aedc55633","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1e3f5698-f962-4f55-82ce-656aedc55633","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1e3f5698-f962-4f55-82ce-656aedc55633","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1e3f5698-f962-4f55-82ce-656aedc55633","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1e3f5698-f962-4f55-82ce-656aedc55633","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"abbb7d7d-56cc-4dc2-b0ae-a54bd372f210","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41558","PortSpecifier":{"PortValue":41558}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"abbb7d7d-56cc-4dc2-b0ae-a54bd372f210","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"abbb7d7d-56cc-4dc2-b0ae-a54bd372f210","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41558","PortSpecifier":{"PortValue":41558}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435535,"nanos":254672918},"http":{"id":"abbb7d7d-56cc-4dc2-b0ae-a54bd372f210","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"abbb7d7d-56cc-4dc2-b0ae-a54bd372f210","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"abbb7d7d-56cc-4dc2-b0ae-a54bd372f210","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"abbb7d7d-56cc-4dc2-b0ae-a54bd372f210","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"abbb7d7d-56cc-4dc2-b0ae-a54bd372f210"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"abbb7d7d-56cc-4dc2-b0ae-a54bd372f210","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":254672918,"seconds":1783435535},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:41558","port":41558}}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"abbb7d7d-56cc-4dc2-b0ae-a54bd372f210","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"abbb7d7d-56cc-4dc2-b0ae-a54bd372f210","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"abbb7d7d-56cc-4dc2-b0ae-a54bd372f210","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"abbb7d7d-56cc-4dc2-b0ae-a54bd372f210","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"abbb7d7d-56cc-4dc2-b0ae-a54bd372f210","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"abbb7d7d-56cc-4dc2-b0ae-a54bd372f210","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"abbb7d7d-56cc-4dc2-b0ae-a54bd372f210","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"abbb7d7d-56cc-4dc2-b0ae-a54bd372f210","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"abbb7d7d-56cc-4dc2-b0ae-a54bd372f210","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"30693919-54a2-4d4d-92be-edd25d3e6d21","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41568","PortSpecifier":{"PortValue":41568}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"30693919-54a2-4d4d-92be-edd25d3e6d21","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"30693919-54a2-4d4d-92be-edd25d3e6d21","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41568","PortSpecifier":{"PortValue":41568}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435535,"nanos":303944139},"http":{"id":"30693919-54a2-4d4d-92be-edd25d3e6d21","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"30693919-54a2-4d4d-92be-edd25d3e6d21","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"30693919-54a2-4d4d-92be-edd25d3e6d21","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"30693919-54a2-4d4d-92be-edd25d3e6d21","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"30693919-54a2-4d4d-92be-edd25d3e6d21"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"30693919-54a2-4d4d-92be-edd25d3e6d21","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":303944139,"seconds":1783435535},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:41568","port":41568}}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"30693919-54a2-4d4d-92be-edd25d3e6d21","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"30693919-54a2-4d4d-92be-edd25d3e6d21","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"30693919-54a2-4d4d-92be-edd25d3e6d21","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"30693919-54a2-4d4d-92be-edd25d3e6d21","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"30693919-54a2-4d4d-92be-edd25d3e6d21","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"30693919-54a2-4d4d-92be-edd25d3e6d21","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"30693919-54a2-4d4d-92be-edd25d3e6d21","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"30693919-54a2-4d4d-92be-edd25d3e6d21","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"30693919-54a2-4d4d-92be-edd25d3e6d21","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ebc5aece-61c3-4843-aa8b-5fcf19b03158","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41572","PortSpecifier":{"PortValue":41572}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ebc5aece-61c3-4843-aa8b-5fcf19b03158","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ebc5aece-61c3-4843-aa8b-5fcf19b03158","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41572","PortSpecifier":{"PortValue":41572}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435535,"nanos":356320436},"http":{"id":"ebc5aece-61c3-4843-aa8b-5fcf19b03158","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"ebc5aece-61c3-4843-aa8b-5fcf19b03158","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ebc5aece-61c3-4843-aa8b-5fcf19b03158","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ebc5aece-61c3-4843-aa8b-5fcf19b03158","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"ebc5aece-61c3-4843-aa8b-5fcf19b03158"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"ebc5aece-61c3-4843-aa8b-5fcf19b03158","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":356320436,"seconds":1783435535},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:41572","port":41572}}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ebc5aece-61c3-4843-aa8b-5fcf19b03158","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ebc5aece-61c3-4843-aa8b-5fcf19b03158","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ebc5aece-61c3-4843-aa8b-5fcf19b03158","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"ebc5aece-61c3-4843-aa8b-5fcf19b03158","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ebc5aece-61c3-4843-aa8b-5fcf19b03158","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ebc5aece-61c3-4843-aa8b-5fcf19b03158","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ebc5aece-61c3-4843-aa8b-5fcf19b03158","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ebc5aece-61c3-4843-aa8b-5fcf19b03158","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ebc5aece-61c3-4843-aa8b-5fcf19b03158","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8dac0002-5c94-44c7-873a-0721703d68a9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41588","PortSpecifier":{"PortValue":41588}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"8dac0002-5c94-44c7-873a-0721703d68a9","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8dac0002-5c94-44c7-873a-0721703d68a9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41588","PortSpecifier":{"PortValue":41588}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435535,"nanos":404136811},"http":{"id":"8dac0002-5c94-44c7-873a-0721703d68a9","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"8dac0002-5c94-44c7-873a-0721703d68a9","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"8dac0002-5c94-44c7-873a-0721703d68a9","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"8dac0002-5c94-44c7-873a-0721703d68a9","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"8dac0002-5c94-44c7-873a-0721703d68a9"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"8dac0002-5c94-44c7-873a-0721703d68a9","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":404136811,"seconds":1783435535},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:41588","port":41588}}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8dac0002-5c94-44c7-873a-0721703d68a9","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8dac0002-5c94-44c7-873a-0721703d68a9","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8dac0002-5c94-44c7-873a-0721703d68a9","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"8dac0002-5c94-44c7-873a-0721703d68a9","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8dac0002-5c94-44c7-873a-0721703d68a9","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8dac0002-5c94-44c7-873a-0721703d68a9","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8dac0002-5c94-44c7-873a-0721703d68a9","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8dac0002-5c94-44c7-873a-0721703d68a9","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8dac0002-5c94-44c7-873a-0721703d68a9","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ed9465ee-a4c4-4265-84a0-709f37005268","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41602","PortSpecifier":{"PortValue":41602}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ed9465ee-a4c4-4265-84a0-709f37005268","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ed9465ee-a4c4-4265-84a0-709f37005268","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41602","PortSpecifier":{"PortValue":41602}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435535,"nanos":454404556},"http":{"id":"ed9465ee-a4c4-4265-84a0-709f37005268","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"ed9465ee-a4c4-4265-84a0-709f37005268","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ed9465ee-a4c4-4265-84a0-709f37005268","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ed9465ee-a4c4-4265-84a0-709f37005268","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"ed9465ee-a4c4-4265-84a0-709f37005268"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"ed9465ee-a4c4-4265-84a0-709f37005268","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":454404556,"seconds":1783435535},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:41602","port":41602}}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ed9465ee-a4c4-4265-84a0-709f37005268","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ed9465ee-a4c4-4265-84a0-709f37005268","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ed9465ee-a4c4-4265-84a0-709f37005268","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"ed9465ee-a4c4-4265-84a0-709f37005268","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ed9465ee-a4c4-4265-84a0-709f37005268","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ed9465ee-a4c4-4265-84a0-709f37005268","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ed9465ee-a4c4-4265-84a0-709f37005268","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ed9465ee-a4c4-4265-84a0-709f37005268","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ed9465ee-a4c4-4265-84a0-709f37005268","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f3dab147-a167-4e98-b361-be4199bbd188","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41614","PortSpecifier":{"PortValue":41614}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f3dab147-a167-4e98-b361-be4199bbd188","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f3dab147-a167-4e98-b361-be4199bbd188","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41614","PortSpecifier":{"PortValue":41614}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435535,"nanos":506726442},"http":{"id":"f3dab147-a167-4e98-b361-be4199bbd188","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"f3dab147-a167-4e98-b361-be4199bbd188","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f3dab147-a167-4e98-b361-be4199bbd188","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f3dab147-a167-4e98-b361-be4199bbd188","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"f3dab147-a167-4e98-b361-be4199bbd188"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"f3dab147-a167-4e98-b361-be4199bbd188","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":506726442,"seconds":1783435535},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:41614","port":41614}}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f3dab147-a167-4e98-b361-be4199bbd188","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f3dab147-a167-4e98-b361-be4199bbd188","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f3dab147-a167-4e98-b361-be4199bbd188","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"f3dab147-a167-4e98-b361-be4199bbd188","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f3dab147-a167-4e98-b361-be4199bbd188","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f3dab147-a167-4e98-b361-be4199bbd188","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f3dab147-a167-4e98-b361-be4199bbd188","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f3dab147-a167-4e98-b361-be4199bbd188","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f3dab147-a167-4e98-b361-be4199bbd188","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"867e45e3-7988-4066-b607-a12e7044a102","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41620","PortSpecifier":{"PortValue":41620}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"867e45e3-7988-4066-b607-a12e7044a102","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"867e45e3-7988-4066-b607-a12e7044a102","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41620","PortSpecifier":{"PortValue":41620}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435535,"nanos":554155115},"http":{"id":"867e45e3-7988-4066-b607-a12e7044a102","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"867e45e3-7988-4066-b607-a12e7044a102","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"867e45e3-7988-4066-b607-a12e7044a102","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"867e45e3-7988-4066-b607-a12e7044a102","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"867e45e3-7988-4066-b607-a12e7044a102"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"867e45e3-7988-4066-b607-a12e7044a102","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":554155115,"seconds":1783435535},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:41620","port":41620}}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"867e45e3-7988-4066-b607-a12e7044a102","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"867e45e3-7988-4066-b607-a12e7044a102","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"867e45e3-7988-4066-b607-a12e7044a102","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"867e45e3-7988-4066-b607-a12e7044a102","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"867e45e3-7988-4066-b607-a12e7044a102","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"867e45e3-7988-4066-b607-a12e7044a102","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"867e45e3-7988-4066-b607-a12e7044a102","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"867e45e3-7988-4066-b607-a12e7044a102","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"867e45e3-7988-4066-b607-a12e7044a102","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f7f71bf1-532f-48db-b255-9623e9b83ec3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41636","PortSpecifier":{"PortValue":41636}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f7f71bf1-532f-48db-b255-9623e9b83ec3","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f7f71bf1-532f-48db-b255-9623e9b83ec3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41636","PortSpecifier":{"PortValue":41636}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435535,"nanos":604255059},"http":{"id":"f7f71bf1-532f-48db-b255-9623e9b83ec3","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"f7f71bf1-532f-48db-b255-9623e9b83ec3","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f7f71bf1-532f-48db-b255-9623e9b83ec3","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f7f71bf1-532f-48db-b255-9623e9b83ec3","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"f7f71bf1-532f-48db-b255-9623e9b83ec3"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"f7f71bf1-532f-48db-b255-9623e9b83ec3","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":604255059,"seconds":1783435535},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:41636","port":41636}}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f7f71bf1-532f-48db-b255-9623e9b83ec3","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f7f71bf1-532f-48db-b255-9623e9b83ec3","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f7f71bf1-532f-48db-b255-9623e9b83ec3","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"f7f71bf1-532f-48db-b255-9623e9b83ec3","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f7f71bf1-532f-48db-b255-9623e9b83ec3","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f7f71bf1-532f-48db-b255-9623e9b83ec3","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f7f71bf1-532f-48db-b255-9623e9b83ec3","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f7f71bf1-532f-48db-b255-9623e9b83ec3","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f7f71bf1-532f-48db-b255-9623e9b83ec3","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a050e748-0ac5-4437-8016-ff80222b011b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41650","PortSpecifier":{"PortValue":41650}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a050e748-0ac5-4437-8016-ff80222b011b","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a050e748-0ac5-4437-8016-ff80222b011b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41650","PortSpecifier":{"PortValue":41650}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435535,"nanos":654124727},"http":{"id":"a050e748-0ac5-4437-8016-ff80222b011b","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"a050e748-0ac5-4437-8016-ff80222b011b","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a050e748-0ac5-4437-8016-ff80222b011b","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a050e748-0ac5-4437-8016-ff80222b011b","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"a050e748-0ac5-4437-8016-ff80222b011b"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"a050e748-0ac5-4437-8016-ff80222b011b","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":654124727,"seconds":1783435535},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:41650","port":41650}}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a050e748-0ac5-4437-8016-ff80222b011b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a050e748-0ac5-4437-8016-ff80222b011b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a050e748-0ac5-4437-8016-ff80222b011b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"a050e748-0ac5-4437-8016-ff80222b011b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a050e748-0ac5-4437-8016-ff80222b011b","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a050e748-0ac5-4437-8016-ff80222b011b","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a050e748-0ac5-4437-8016-ff80222b011b","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a050e748-0ac5-4437-8016-ff80222b011b","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a050e748-0ac5-4437-8016-ff80222b011b","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"29474a93-b430-44e6-9df4-700bd28705fc","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41654","PortSpecifier":{"PortValue":41654}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"29474a93-b430-44e6-9df4-700bd28705fc","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"29474a93-b430-44e6-9df4-700bd28705fc","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41654","PortSpecifier":{"PortValue":41654}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435535,"nanos":704738082},"http":{"id":"29474a93-b430-44e6-9df4-700bd28705fc","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"29474a93-b430-44e6-9df4-700bd28705fc","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"29474a93-b430-44e6-9df4-700bd28705fc","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"29474a93-b430-44e6-9df4-700bd28705fc","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"29474a93-b430-44e6-9df4-700bd28705fc"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"29474a93-b430-44e6-9df4-700bd28705fc","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":704738082,"seconds":1783435535},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:41654","port":41654}}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"29474a93-b430-44e6-9df4-700bd28705fc","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"29474a93-b430-44e6-9df4-700bd28705fc","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"29474a93-b430-44e6-9df4-700bd28705fc","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"29474a93-b430-44e6-9df4-700bd28705fc","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"29474a93-b430-44e6-9df4-700bd28705fc","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"29474a93-b430-44e6-9df4-700bd28705fc","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"29474a93-b430-44e6-9df4-700bd28705fc","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"29474a93-b430-44e6-9df4-700bd28705fc","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"29474a93-b430-44e6-9df4-700bd28705fc","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"27830339-1004-4f79-ab63-00d469823397","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41660","PortSpecifier":{"PortValue":41660}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"27830339-1004-4f79-ab63-00d469823397","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"27830339-1004-4f79-ab63-00d469823397","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41660","PortSpecifier":{"PortValue":41660}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435535,"nanos":754299200},"http":{"id":"27830339-1004-4f79-ab63-00d469823397","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"27830339-1004-4f79-ab63-00d469823397","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"27830339-1004-4f79-ab63-00d469823397","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"27830339-1004-4f79-ab63-00d469823397","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"27830339-1004-4f79-ab63-00d469823397"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"27830339-1004-4f79-ab63-00d469823397","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":754299200,"seconds":1783435535},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:41660","port":41660}}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"27830339-1004-4f79-ab63-00d469823397","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"27830339-1004-4f79-ab63-00d469823397","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"27830339-1004-4f79-ab63-00d469823397","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"27830339-1004-4f79-ab63-00d469823397","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"27830339-1004-4f79-ab63-00d469823397","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"27830339-1004-4f79-ab63-00d469823397","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"27830339-1004-4f79-ab63-00d469823397","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"27830339-1004-4f79-ab63-00d469823397","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"27830339-1004-4f79-ab63-00d469823397","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"589a7b01-0df8-4593-a4f2-8e9ba40d3627","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41664","PortSpecifier":{"PortValue":41664}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"589a7b01-0df8-4593-a4f2-8e9ba40d3627","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"589a7b01-0df8-4593-a4f2-8e9ba40d3627","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41664","PortSpecifier":{"PortValue":41664}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435535,"nanos":804212114},"http":{"id":"589a7b01-0df8-4593-a4f2-8e9ba40d3627","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"589a7b01-0df8-4593-a4f2-8e9ba40d3627","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"589a7b01-0df8-4593-a4f2-8e9ba40d3627","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"589a7b01-0df8-4593-a4f2-8e9ba40d3627","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"589a7b01-0df8-4593-a4f2-8e9ba40d3627"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"589a7b01-0df8-4593-a4f2-8e9ba40d3627","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":804212114,"seconds":1783435535},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:41664","port":41664}}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"589a7b01-0df8-4593-a4f2-8e9ba40d3627","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"589a7b01-0df8-4593-a4f2-8e9ba40d3627","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"589a7b01-0df8-4593-a4f2-8e9ba40d3627","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"589a7b01-0df8-4593-a4f2-8e9ba40d3627","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"589a7b01-0df8-4593-a4f2-8e9ba40d3627","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"589a7b01-0df8-4593-a4f2-8e9ba40d3627","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"589a7b01-0df8-4593-a4f2-8e9ba40d3627","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"589a7b01-0df8-4593-a4f2-8e9ba40d3627","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"589a7b01-0df8-4593-a4f2-8e9ba40d3627","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"90468c86-2898-40a8-86bf-a864849e5a70","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41672","PortSpecifier":{"PortValue":41672}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"90468c86-2898-40a8-86bf-a864849e5a70","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"90468c86-2898-40a8-86bf-a864849e5a70","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41672","PortSpecifier":{"PortValue":41672}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435535,"nanos":853383265},"http":{"id":"90468c86-2898-40a8-86bf-a864849e5a70","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"90468c86-2898-40a8-86bf-a864849e5a70","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"90468c86-2898-40a8-86bf-a864849e5a70","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"90468c86-2898-40a8-86bf-a864849e5a70","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"90468c86-2898-40a8-86bf-a864849e5a70"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"90468c86-2898-40a8-86bf-a864849e5a70","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":853383265,"seconds":1783435535},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:41672","port":41672}}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"90468c86-2898-40a8-86bf-a864849e5a70","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"90468c86-2898-40a8-86bf-a864849e5a70","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"90468c86-2898-40a8-86bf-a864849e5a70","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"90468c86-2898-40a8-86bf-a864849e5a70","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"90468c86-2898-40a8-86bf-a864849e5a70","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"90468c86-2898-40a8-86bf-a864849e5a70","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"90468c86-2898-40a8-86bf-a864849e5a70","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"90468c86-2898-40a8-86bf-a864849e5a70","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"90468c86-2898-40a8-86bf-a864849e5a70","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f4d5628b-2edd-43fe-ab28-71df3ff151bb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41676","PortSpecifier":{"PortValue":41676}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f4d5628b-2edd-43fe-ab28-71df3ff151bb","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f4d5628b-2edd-43fe-ab28-71df3ff151bb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41676","PortSpecifier":{"PortValue":41676}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435535,"nanos":904163067},"http":{"id":"f4d5628b-2edd-43fe-ab28-71df3ff151bb","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"f4d5628b-2edd-43fe-ab28-71df3ff151bb","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f4d5628b-2edd-43fe-ab28-71df3ff151bb","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f4d5628b-2edd-43fe-ab28-71df3ff151bb","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"f4d5628b-2edd-43fe-ab28-71df3ff151bb"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"f4d5628b-2edd-43fe-ab28-71df3ff151bb","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":904163067,"seconds":1783435535},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:41676","port":41676}}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f4d5628b-2edd-43fe-ab28-71df3ff151bb","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f4d5628b-2edd-43fe-ab28-71df3ff151bb","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f4d5628b-2edd-43fe-ab28-71df3ff151bb","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"f4d5628b-2edd-43fe-ab28-71df3ff151bb","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f4d5628b-2edd-43fe-ab28-71df3ff151bb","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f4d5628b-2edd-43fe-ab28-71df3ff151bb","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f4d5628b-2edd-43fe-ab28-71df3ff151bb","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f4d5628b-2edd-43fe-ab28-71df3ff151bb","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f4d5628b-2edd-43fe-ab28-71df3ff151bb","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"73d0f105-af76-4bff-98a6-1b88184204df","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41680","PortSpecifier":{"PortValue":41680}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"73d0f105-af76-4bff-98a6-1b88184204df","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"73d0f105-af76-4bff-98a6-1b88184204df","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41680","PortSpecifier":{"PortValue":41680}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435535,"nanos":954187689},"http":{"id":"73d0f105-af76-4bff-98a6-1b88184204df","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"73d0f105-af76-4bff-98a6-1b88184204df","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"73d0f105-af76-4bff-98a6-1b88184204df","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"73d0f105-af76-4bff-98a6-1b88184204df","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"73d0f105-af76-4bff-98a6-1b88184204df"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"73d0f105-af76-4bff-98a6-1b88184204df","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":954187689,"seconds":1783435535},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:41680","port":41680}}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"73d0f105-af76-4bff-98a6-1b88184204df","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"73d0f105-af76-4bff-98a6-1b88184204df","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"73d0f105-af76-4bff-98a6-1b88184204df","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"73d0f105-af76-4bff-98a6-1b88184204df","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"73d0f105-af76-4bff-98a6-1b88184204df","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"73d0f105-af76-4bff-98a6-1b88184204df","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"73d0f105-af76-4bff-98a6-1b88184204df","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"73d0f105-af76-4bff-98a6-1b88184204df","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"73d0f105-af76-4bff-98a6-1b88184204df","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9550c861-fa21-4879-ad70-39520aefac45","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41690","PortSpecifier":{"PortValue":41690}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9550c861-fa21-4879-ad70-39520aefac45","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9550c861-fa21-4879-ad70-39520aefac45","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41690","PortSpecifier":{"PortValue":41690}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435536,"nanos":11146575},"http":{"id":"9550c861-fa21-4879-ad70-39520aefac45","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"9550c861-fa21-4879-ad70-39520aefac45","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9550c861-fa21-4879-ad70-39520aefac45","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9550c861-fa21-4879-ad70-39520aefac45","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"9550c861-fa21-4879-ad70-39520aefac45"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"9550c861-fa21-4879-ad70-39520aefac45","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":11146575,"seconds":1783435536},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:41690","port":41690}}}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9550c861-fa21-4879-ad70-39520aefac45","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9550c861-fa21-4879-ad70-39520aefac45","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9550c861-fa21-4879-ad70-39520aefac45","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"9550c861-fa21-4879-ad70-39520aefac45","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9550c861-fa21-4879-ad70-39520aefac45","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9550c861-fa21-4879-ad70-39520aefac45","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9550c861-fa21-4879-ad70-39520aefac45","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9550c861-fa21-4879-ad70-39520aefac45","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9550c861-fa21-4879-ad70-39520aefac45","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"12435add-0208-4ba0-bf16-f61fcbd7d369","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41702","PortSpecifier":{"PortValue":41702}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"12435add-0208-4ba0-bf16-f61fcbd7d369","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"12435add-0208-4ba0-bf16-f61fcbd7d369","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41702","PortSpecifier":{"PortValue":41702}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435536,"nanos":54735967},"http":{"id":"12435add-0208-4ba0-bf16-f61fcbd7d369","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"12435add-0208-4ba0-bf16-f61fcbd7d369","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"12435add-0208-4ba0-bf16-f61fcbd7d369","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"12435add-0208-4ba0-bf16-f61fcbd7d369","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"12435add-0208-4ba0-bf16-f61fcbd7d369"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"12435add-0208-4ba0-bf16-f61fcbd7d369","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":54735967,"seconds":1783435536},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:41702","port":41702}}}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"12435add-0208-4ba0-bf16-f61fcbd7d369","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"12435add-0208-4ba0-bf16-f61fcbd7d369","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"12435add-0208-4ba0-bf16-f61fcbd7d369","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"12435add-0208-4ba0-bf16-f61fcbd7d369","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"12435add-0208-4ba0-bf16-f61fcbd7d369","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"12435add-0208-4ba0-bf16-f61fcbd7d369","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"12435add-0208-4ba0-bf16-f61fcbd7d369","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"12435add-0208-4ba0-bf16-f61fcbd7d369","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"12435add-0208-4ba0-bf16-f61fcbd7d369","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b147939c-4f19-4599-8357-5d8480f5094d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41714","PortSpecifier":{"PortValue":41714}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b147939c-4f19-4599-8357-5d8480f5094d","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b147939c-4f19-4599-8357-5d8480f5094d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41714","PortSpecifier":{"PortValue":41714}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435536,"nanos":104745588},"http":{"id":"b147939c-4f19-4599-8357-5d8480f5094d","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"b147939c-4f19-4599-8357-5d8480f5094d","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b147939c-4f19-4599-8357-5d8480f5094d","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b147939c-4f19-4599-8357-5d8480f5094d","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"b147939c-4f19-4599-8357-5d8480f5094d"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"b147939c-4f19-4599-8357-5d8480f5094d","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":104745588,"seconds":1783435536},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:41714","port":41714}}}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b147939c-4f19-4599-8357-5d8480f5094d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b147939c-4f19-4599-8357-5d8480f5094d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b147939c-4f19-4599-8357-5d8480f5094d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"b147939c-4f19-4599-8357-5d8480f5094d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b147939c-4f19-4599-8357-5d8480f5094d","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b147939c-4f19-4599-8357-5d8480f5094d","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b147939c-4f19-4599-8357-5d8480f5094d","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b147939c-4f19-4599-8357-5d8480f5094d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b147939c-4f19-4599-8357-5d8480f5094d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9e430313-6209-4cd7-af62-1cb06222b969","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41728","PortSpecifier":{"PortValue":41728}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9e430313-6209-4cd7-af62-1cb06222b969","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9e430313-6209-4cd7-af62-1cb06222b969","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41728","PortSpecifier":{"PortValue":41728}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435536,"nanos":154821208},"http":{"id":"9e430313-6209-4cd7-af62-1cb06222b969","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"9e430313-6209-4cd7-af62-1cb06222b969","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9e430313-6209-4cd7-af62-1cb06222b969","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9e430313-6209-4cd7-af62-1cb06222b969","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"9e430313-6209-4cd7-af62-1cb06222b969"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"9e430313-6209-4cd7-af62-1cb06222b969","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":154821208,"seconds":1783435536},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:41728","port":41728}}}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9e430313-6209-4cd7-af62-1cb06222b969","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9e430313-6209-4cd7-af62-1cb06222b969","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9e430313-6209-4cd7-af62-1cb06222b969","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"9e430313-6209-4cd7-af62-1cb06222b969","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9e430313-6209-4cd7-af62-1cb06222b969","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9e430313-6209-4cd7-af62-1cb06222b969","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9e430313-6209-4cd7-af62-1cb06222b969","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9e430313-6209-4cd7-af62-1cb06222b969","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9e430313-6209-4cd7-af62-1cb06222b969","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"16694d62-a923-48f7-ab8a-b4e68648f984","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41734","PortSpecifier":{"PortValue":41734}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"16694d62-a923-48f7-ab8a-b4e68648f984","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"16694d62-a923-48f7-ab8a-b4e68648f984","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41734","PortSpecifier":{"PortValue":41734}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435536,"nanos":204985443},"http":{"id":"16694d62-a923-48f7-ab8a-b4e68648f984","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"16694d62-a923-48f7-ab8a-b4e68648f984","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"16694d62-a923-48f7-ab8a-b4e68648f984","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"16694d62-a923-48f7-ab8a-b4e68648f984","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"16694d62-a923-48f7-ab8a-b4e68648f984"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"16694d62-a923-48f7-ab8a-b4e68648f984","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":204985443,"seconds":1783435536},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:41734","port":41734}}}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"16694d62-a923-48f7-ab8a-b4e68648f984","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"16694d62-a923-48f7-ab8a-b4e68648f984","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"16694d62-a923-48f7-ab8a-b4e68648f984","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"16694d62-a923-48f7-ab8a-b4e68648f984","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"16694d62-a923-48f7-ab8a-b4e68648f984","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"16694d62-a923-48f7-ab8a-b4e68648f984","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"16694d62-a923-48f7-ab8a-b4e68648f984","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"16694d62-a923-48f7-ab8a-b4e68648f984","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"16694d62-a923-48f7-ab8a-b4e68648f984","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5eeee0ed-4097-45b8-ae95-0795e3dc2e5f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41748","PortSpecifier":{"PortValue":41748}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5eeee0ed-4097-45b8-ae95-0795e3dc2e5f","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5eeee0ed-4097-45b8-ae95-0795e3dc2e5f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41748","PortSpecifier":{"PortValue":41748}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435536,"nanos":255376448},"http":{"id":"5eeee0ed-4097-45b8-ae95-0795e3dc2e5f","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"5eeee0ed-4097-45b8-ae95-0795e3dc2e5f","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5eeee0ed-4097-45b8-ae95-0795e3dc2e5f","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5eeee0ed-4097-45b8-ae95-0795e3dc2e5f","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"5eeee0ed-4097-45b8-ae95-0795e3dc2e5f"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"5eeee0ed-4097-45b8-ae95-0795e3dc2e5f","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":255376448,"seconds":1783435536},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:41748","port":41748}}}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5eeee0ed-4097-45b8-ae95-0795e3dc2e5f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5eeee0ed-4097-45b8-ae95-0795e3dc2e5f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5eeee0ed-4097-45b8-ae95-0795e3dc2e5f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"5eeee0ed-4097-45b8-ae95-0795e3dc2e5f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5eeee0ed-4097-45b8-ae95-0795e3dc2e5f","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5eeee0ed-4097-45b8-ae95-0795e3dc2e5f","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5eeee0ed-4097-45b8-ae95-0795e3dc2e5f","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5eeee0ed-4097-45b8-ae95-0795e3dc2e5f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5eeee0ed-4097-45b8-ae95-0795e3dc2e5f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"35e8832e-b485-4869-b89d-bad7412999cd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41754","PortSpecifier":{"PortValue":41754}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"35e8832e-b485-4869-b89d-bad7412999cd","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"35e8832e-b485-4869-b89d-bad7412999cd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41754","PortSpecifier":{"PortValue":41754}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435536,"nanos":304532209},"http":{"id":"35e8832e-b485-4869-b89d-bad7412999cd","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"35e8832e-b485-4869-b89d-bad7412999cd","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"35e8832e-b485-4869-b89d-bad7412999cd","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"35e8832e-b485-4869-b89d-bad7412999cd","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"35e8832e-b485-4869-b89d-bad7412999cd"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"35e8832e-b485-4869-b89d-bad7412999cd","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":304532209,"seconds":1783435536},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:41754","port":41754}}}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"35e8832e-b485-4869-b89d-bad7412999cd","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"35e8832e-b485-4869-b89d-bad7412999cd","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"35e8832e-b485-4869-b89d-bad7412999cd","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"35e8832e-b485-4869-b89d-bad7412999cd","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"35e8832e-b485-4869-b89d-bad7412999cd","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"35e8832e-b485-4869-b89d-bad7412999cd","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"35e8832e-b485-4869-b89d-bad7412999cd","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"35e8832e-b485-4869-b89d-bad7412999cd","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"35e8832e-b485-4869-b89d-bad7412999cd","authorized":true,"response":"OK"}