{"level":"debug","ts":"2026-07-24T16:20:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"574c919e-7e48-4695-a565-fce92ed16dce","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:20:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"574c919e-7e48-4695-a565-fce92ed16dce","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:20:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"574c919e-7e48-4695-a565-fce92ed16dce","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-fafc28/rate-test-model-fafc28\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-fafc28/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:20:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"574c919e-7e48-4695-a565-fce92ed16dce","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-24T16:20:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"574c919e-7e48-4695-a565-fce92ed16dce","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T16:20:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"574c919e-7e48-4695-a565-fce92ed16dce","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-24T16:20:40Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"574c919e-7e48-4695-a565-fce92ed16dce","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T16:20:40Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"574c919e-7e48-4695-a565-fce92ed16dce","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T16:20:40Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7667fd69-4024-442f-90fd-df46683690e6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:45414","PortSpecifier":{"PortValue":45414}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"7667fd69-4024-442f-90fd-df46683690e6","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-c6c91e.apps.fcfd467d-eea8-41c6-9191-af8557b854d0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T16:20:40Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7667fd69-4024-442f-90fd-df46683690e6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:45414","PortSpecifier":{"PortValue":45414}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784910040,"nanos":625333288},"http":{"id":"7667fd69-4024-442f-90fd-df46683690e6","method":"POST","headers":{":authority":"e2e-shared-b-c6c91e.apps.fcfd467d-eea8-41c6-9191-af8557b854d0.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T16:20:40Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"7667fd69-4024-442f-90fd-df46683690e6","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-24T16:20:40Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"7667fd69-4024-442f-90fd-df46683690e6","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"cfa92684-529a-4738-904f-2f855e0bf7d0","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=674fb2f7-2bd8-4cd9-8782-38d631eb1bc5"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/af8557b854d0"]}}
{"level":"debug","ts":"2026-07-24T16:20:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"7667fd69-4024-442f-90fd-df46683690e6","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/af8557b854d0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=674fb2f7-2bd8-4cd9-8782-38d631eb1bc5"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"cfa92684-529a-4738-904f-2f855e0bf7d0","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"83c59eb3611e84dfaf5728b452d87e80d9cb9264be64f3976f4e57ac33062dab"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-c6c91e.apps.fcfd467d-eea8-41c6-9191-af8557b854d0.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T16:20:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7667fd69-4024-442f-90fd-df46683690e6","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:20:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7667fd69-4024-442f-90fd-df46683690e6","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:20:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7667fd69-4024-442f-90fd-df46683690e6","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-c6c91e/rate-test-model-c6c91e\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-c6c91e/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:20:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"7667fd69-4024-442f-90fd-df46683690e6","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-24T16:20:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7667fd69-4024-442f-90fd-df46683690e6","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T16:20:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7667fd69-4024-442f-90fd-df46683690e6","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-24T16:20:40Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7667fd69-4024-442f-90fd-df46683690e6","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T16:20:40Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7667fd69-4024-442f-90fd-df46683690e6","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T16:20:40Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e73fd854-78b8-4932-9c7b-a5f74a9a8e8e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:60544","PortSpecifier":{"PortValue":60544}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.50:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e73fd854-78b8-4932-9c7b-a5f74a9a8e8e","method":"POST","path":"/ai-tenant-e2e-shared-a-fafc28/rate-test-model-fafc28/v1/completions","host":"e2e-shared-a-fafc28.apps.fcfd467d-eea8-41c6-9191-af8557b854d0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T16:20:40Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e73fd854-78b8-4932-9c7b-a5f74a9a8e8e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:60544","PortSpecifier":{"PortValue":60544}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.50:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784910040,"nanos":665513190},"http":{"id":"e73fd854-78b8-4932-9c7b-a5f74a9a8e8e","method":"POST","headers":{":authority":"e2e-shared-a-fafc28.apps.fcfd467d-eea8-41c6-9191-af8557b854d0.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-fafc28/rate-test-model-fafc28/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T16:20:40Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e73fd854-78b8-4932-9c7b-a5f74a9a8e8e","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-6r56pItm2QfyGOQ5_KZG9vBens43K8vxLOdZHe0BXePXOHj87V2y8uEqkdXR"}
{"level":"debug","ts":"2026-07-24T16:20:40Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e73fd854-78b8-4932-9c7b-a5f74a9a8e8e","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-fafc28.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-6r56pItm2QfyGOQ5_KZG9vBens43K8vxLOdZHe0BXePXOHj87V2y8uEqkdXR\"}"}
{"level":"debug","ts":"2026-07-24T16:20:40Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e73fd854-78b8-4932-9c7b-a5f74a9a8e8e","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-fafc28.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"c3a2b8c4-bc52-4fc4-88bc-e8a9c8b5d420","keyName":"e2e-rate-a-d8b5a8","subscription":"e2e-rate-iso-a-d8b5a8","tenant":"e2e-shared-a-fafc28","userId":"c3a2b8c4-bc52-4fc4-88bc-e8a9c8b5d420","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T16:20:40Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e73fd854-78b8-4932-9c7b-a5f74a9a8e8e","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-fafc28.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-fafc28/rate-test-model-fafc28\",\"requestedSubscription\":\"e2e-rate-iso-a-d8b5a8\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T16:20:40Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e73fd854-78b8-4932-9c7b-a5f74a9a8e8e","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-fafc28.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-fafc28","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d8b5a8","namespace":"ai-tenant-e2e-shared-a-fafc28","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-fafc28/rate-test-model-fafc28"}}
{"level":"debug","ts":"2026-07-24T16:20:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e73fd854-78b8-4932-9c7b-a5f74a9a8e8e","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T16:20:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e73fd854-78b8-4932-9c7b-a5f74a9a8e8e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:20:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e73fd854-78b8-4932-9c7b-a5f74a9a8e8e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:20:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e73fd854-78b8-4932-9c7b-a5f74a9a8e8e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-fafc28/rate-test-model-fafc28\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-fafc28/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:20:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e73fd854-78b8-4932-9c7b-a5f74a9a8e8e","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:20:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e73fd854-78b8-4932-9c7b-a5f74a9a8e8e","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T16:20:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e73fd854-78b8-4932-9c7b-a5f74a9a8e8e","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-d8b5a8"}
{"level":"debug","ts":"2026-07-24T16:20:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e73fd854-78b8-4932-9c7b-a5f74a9a8e8e","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T16:20:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e73fd854-78b8-4932-9c7b-a5f74a9a8e8e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"c3a2b8c4-bc52-4fc4-88bc-e8a9c8b5d420","keyName":"e2e-rate-a-d8b5a8","selected_subscription":"e2e-rate-iso-a-d8b5a8","selected_subscription_key":"ai-tenant-e2e-shared-a-fafc28/e2e-rate-iso-a-d8b5a8@ai-tenant-e2e-shared-a-fafc28/rate-test-model-fafc28","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-fafc28","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d8b5a8","namespace":"ai-tenant-e2e-shared-a-fafc28","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-fafc28/rate-test-model-fafc28"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T16:20:40Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e73fd854-78b8-4932-9c7b-a5f74a9a8e8e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T16:20:40Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e73fd854-78b8-4932-9c7b-a5f74a9a8e8e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T16:20:41Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9867c69c-1990-42d4-afe7-0b59ac074377","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:60550","PortSpecifier":{"PortValue":60550}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.50:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9867c69c-1990-42d4-afe7-0b59ac074377","method":"POST","path":"/ai-tenant-e2e-shared-a-fafc28/rate-test-model-fafc28/v1/completions","host":"e2e-shared-a-fafc28.apps.fcfd467d-eea8-41c6-9191-af8557b854d0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T16:20:41Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9867c69c-1990-42d4-afe7-0b59ac074377","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:60550","PortSpecifier":{"PortValue":60550}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.50:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784910041,"nanos":710759434},"http":{"id":"9867c69c-1990-42d4-afe7-0b59ac074377","method":"POST","headers":{":authority":"e2e-shared-a-fafc28.apps.fcfd467d-eea8-41c6-9191-af8557b854d0.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-fafc28/rate-test-model-fafc28/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T16:20:41Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9867c69c-1990-42d4-afe7-0b59ac074377","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-6r56pItm2QfyGOQ5_KZG9vBens43K8vxLOdZHe0BXePXOHj87V2y8uEqkdXR"}
{"level":"debug","ts":"2026-07-24T16:20:41Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9867c69c-1990-42d4-afe7-0b59ac074377","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-fafc28.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-6r56pItm2QfyGOQ5_KZG9vBens43K8vxLOdZHe0BXePXOHj87V2y8uEqkdXR\"}"}
{"level":"debug","ts":"2026-07-24T16:20:41Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9867c69c-1990-42d4-afe7-0b59ac074377","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-fafc28.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"c3a2b8c4-bc52-4fc4-88bc-e8a9c8b5d420","keyName":"e2e-rate-a-d8b5a8","subscription":"e2e-rate-iso-a-d8b5a8","tenant":"e2e-shared-a-fafc28","userId":"c3a2b8c4-bc52-4fc4-88bc-e8a9c8b5d420","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T16:20:41Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9867c69c-1990-42d4-afe7-0b59ac074377","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-fafc28.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-fafc28/rate-test-model-fafc28\",\"requestedSubscription\":\"e2e-rate-iso-a-d8b5a8\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T16:20:41Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9867c69c-1990-42d4-afe7-0b59ac074377","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-fafc28.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-fafc28","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d8b5a8","namespace":"ai-tenant-e2e-shared-a-fafc28","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-fafc28/rate-test-model-fafc28"}}
{"level":"debug","ts":"2026-07-24T16:20:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9867c69c-1990-42d4-afe7-0b59ac074377","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T16:20:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9867c69c-1990-42d4-afe7-0b59ac074377","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:20:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9867c69c-1990-42d4-afe7-0b59ac074377","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:20:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9867c69c-1990-42d4-afe7-0b59ac074377","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:20:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9867c69c-1990-42d4-afe7-0b59ac074377","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-fafc28/rate-test-model-fafc28\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-fafc28/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:20:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9867c69c-1990-42d4-afe7-0b59ac074377","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T16:20:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9867c69c-1990-42d4-afe7-0b59ac074377","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-d8b5a8"}
{"level":"debug","ts":"2026-07-24T16:20:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9867c69c-1990-42d4-afe7-0b59ac074377","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T16:20:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9867c69c-1990-42d4-afe7-0b59ac074377","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"c3a2b8c4-bc52-4fc4-88bc-e8a9c8b5d420","keyName":"e2e-rate-a-d8b5a8","selected_subscription":"e2e-rate-iso-a-d8b5a8","selected_subscription_key":"ai-tenant-e2e-shared-a-fafc28/e2e-rate-iso-a-d8b5a8@ai-tenant-e2e-shared-a-fafc28/rate-test-model-fafc28","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-fafc28","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d8b5a8","namespace":"ai-tenant-e2e-shared-a-fafc28","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-fafc28/rate-test-model-fafc28"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T16:20:41Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9867c69c-1990-42d4-afe7-0b59ac074377","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T16:20:41Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9867c69c-1990-42d4-afe7-0b59ac074377","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T16:20:42Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"35d2f04f-d27f-4e41-9ae1-87c867877c32","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:60564","PortSpecifier":{"PortValue":60564}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.50:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"35d2f04f-d27f-4e41-9ae1-87c867877c32","method":"POST","path":"/ai-tenant-e2e-shared-a-fafc28/rate-test-model-fafc28/v1/completions","host":"e2e-shared-a-fafc28.apps.fcfd467d-eea8-41c6-9191-af8557b854d0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T16:20:42Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"35d2f04f-d27f-4e41-9ae1-87c867877c32","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:60564","PortSpecifier":{"PortValue":60564}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.50:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784910042,"nanos":757395047},"http":{"id":"35d2f04f-d27f-4e41-9ae1-87c867877c32","method":"POST","headers":{":authority":"e2e-shared-a-fafc28.apps.fcfd467d-eea8-41c6-9191-af8557b854d0.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-fafc28/rate-test-model-fafc28/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T16:20:42Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"35d2f04f-d27f-4e41-9ae1-87c867877c32","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-6r56pItm2QfyGOQ5_KZG9vBens43K8vxLOdZHe0BXePXOHj87V2y8uEqkdXR"}
{"level":"debug","ts":"2026-07-24T16:20:42Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"35d2f04f-d27f-4e41-9ae1-87c867877c32","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-fafc28.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-6r56pItm2QfyGOQ5_KZG9vBens43K8vxLOdZHe0BXePXOHj87V2y8uEqkdXR\"}"}
{"level":"debug","ts":"2026-07-24T16:20:42Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"35d2f04f-d27f-4e41-9ae1-87c867877c32","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-fafc28.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"c3a2b8c4-bc52-4fc4-88bc-e8a9c8b5d420","keyName":"e2e-rate-a-d8b5a8","subscription":"e2e-rate-iso-a-d8b5a8","tenant":"e2e-shared-a-fafc28","userId":"c3a2b8c4-bc52-4fc4-88bc-e8a9c8b5d420","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T16:20:42Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"35d2f04f-d27f-4e41-9ae1-87c867877c32","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-fafc28.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-fafc28/rate-test-model-fafc28\",\"requestedSubscription\":\"e2e-rate-iso-a-d8b5a8\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T16:20:42Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"35d2f04f-d27f-4e41-9ae1-87c867877c32","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-fafc28.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-fafc28","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d8b5a8","namespace":"ai-tenant-e2e-shared-a-fafc28","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-fafc28/rate-test-model-fafc28"}}
{"level":"debug","ts":"2026-07-24T16:20:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"35d2f04f-d27f-4e41-9ae1-87c867877c32","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T16:20:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"35d2f04f-d27f-4e41-9ae1-87c867877c32","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:20:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"35d2f04f-d27f-4e41-9ae1-87c867877c32","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:20:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"35d2f04f-d27f-4e41-9ae1-87c867877c32","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-fafc28/rate-test-model-fafc28\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-fafc28/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:20:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"35d2f04f-d27f-4e41-9ae1-87c867877c32","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:20:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"35d2f04f-d27f-4e41-9ae1-87c867877c32","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T16:20:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"35d2f04f-d27f-4e41-9ae1-87c867877c32","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T16:20:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"35d2f04f-d27f-4e41-9ae1-87c867877c32","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-d8b5a8"}
{"level":"debug","ts":"2026-07-24T16:20:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"35d2f04f-d27f-4e41-9ae1-87c867877c32","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"c3a2b8c4-bc52-4fc4-88bc-e8a9c8b5d420","keyName":"e2e-rate-a-d8b5a8","selected_subscription":"e2e-rate-iso-a-d8b5a8","selected_subscription_key":"ai-tenant-e2e-shared-a-fafc28/e2e-rate-iso-a-d8b5a8@ai-tenant-e2e-shared-a-fafc28/rate-test-model-fafc28","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-fafc28","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d8b5a8","namespace":"ai-tenant-e2e-shared-a-fafc28","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-fafc28/rate-test-model-fafc28"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T16:20:42Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"35d2f04f-d27f-4e41-9ae1-87c867877c32","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T16:20:42Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"35d2f04f-d27f-4e41-9ae1-87c867877c32","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T16:20:43Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0d588c54-65e5-4a89-b806-e88aac2ebc91","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:60574","PortSpecifier":{"PortValue":60574}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.50:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0d588c54-65e5-4a89-b806-e88aac2ebc91","method":"POST","path":"/ai-tenant-e2e-shared-a-fafc28/rate-test-model-fafc28/v1/completions","host":"e2e-shared-a-fafc28.apps.fcfd467d-eea8-41c6-9191-af8557b854d0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T16:20:43Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0d588c54-65e5-4a89-b806-e88aac2ebc91","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:60574","PortSpecifier":{"PortValue":60574}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.50:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784910043,"nanos":794296031},"http":{"id":"0d588c54-65e5-4a89-b806-e88aac2ebc91","method":"POST","headers":{":authority":"e2e-shared-a-fafc28.apps.fcfd467d-eea8-41c6-9191-af8557b854d0.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-fafc28/rate-test-model-fafc28/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T16:20:43Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0d588c54-65e5-4a89-b806-e88aac2ebc91","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-6r56pItm2QfyGOQ5_KZG9vBens43K8vxLOdZHe0BXePXOHj87V2y8uEqkdXR"}
{"level":"debug","ts":"2026-07-24T16:20:43Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0d588c54-65e5-4a89-b806-e88aac2ebc91","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-fafc28.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-6r56pItm2QfyGOQ5_KZG9vBens43K8vxLOdZHe0BXePXOHj87V2y8uEqkdXR\"}"}
{"level":"debug","ts":"2026-07-24T16:20:43Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0d588c54-65e5-4a89-b806-e88aac2ebc91","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-fafc28.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"c3a2b8c4-bc52-4fc4-88bc-e8a9c8b5d420","keyName":"e2e-rate-a-d8b5a8","subscription":"e2e-rate-iso-a-d8b5a8","tenant":"e2e-shared-a-fafc28","userId":"c3a2b8c4-bc52-4fc4-88bc-e8a9c8b5d420","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T16:20:43Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0d588c54-65e5-4a89-b806-e88aac2ebc91","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-fafc28.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-fafc28/rate-test-model-fafc28\",\"requestedSubscription\":\"e2e-rate-iso-a-d8b5a8\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T16:20:43Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0d588c54-65e5-4a89-b806-e88aac2ebc91","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-fafc28.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-fafc28","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d8b5a8","namespace":"ai-tenant-e2e-shared-a-fafc28","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-fafc28/rate-test-model-fafc28"}}
{"level":"debug","ts":"2026-07-24T16:20:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0d588c54-65e5-4a89-b806-e88aac2ebc91","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T16:20:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0d588c54-65e5-4a89-b806-e88aac2ebc91","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:20:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0d588c54-65e5-4a89-b806-e88aac2ebc91","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:20:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0d588c54-65e5-4a89-b806-e88aac2ebc91","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-fafc28/rate-test-model-fafc28\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-fafc28/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:20:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0d588c54-65e5-4a89-b806-e88aac2ebc91","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:20:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0d588c54-65e5-4a89-b806-e88aac2ebc91","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T16:20:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0d588c54-65e5-4a89-b806-e88aac2ebc91","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-d8b5a8"}
{"level":"debug","ts":"2026-07-24T16:20:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0d588c54-65e5-4a89-b806-e88aac2ebc91","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T16:20:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0d588c54-65e5-4a89-b806-e88aac2ebc91","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"c3a2b8c4-bc52-4fc4-88bc-e8a9c8b5d420","keyName":"e2e-rate-a-d8b5a8","selected_subscription":"e2e-rate-iso-a-d8b5a8","selected_subscription_key":"ai-tenant-e2e-shared-a-fafc28/e2e-rate-iso-a-d8b5a8@ai-tenant-e2e-shared-a-fafc28/rate-test-model-fafc28","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-fafc28","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d8b5a8","namespace":"ai-tenant-e2e-shared-a-fafc28","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-fafc28/rate-test-model-fafc28"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T16:20:43Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0d588c54-65e5-4a89-b806-e88aac2ebc91","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T16:20:43Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0d588c54-65e5-4a89-b806-e88aac2ebc91","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T16:20:44Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f2d0d6d6-044e-4b70-919e-bf56920163cc","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:50646","PortSpecifier":{"PortValue":50646}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.50:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f2d0d6d6-044e-4b70-919e-bf56920163cc","method":"POST","path":"/ai-tenant-e2e-shared-a-fafc28/rate-test-model-fafc28/v1/completions","host":"e2e-shared-a-fafc28.apps.fcfd467d-eea8-41c6-9191-af8557b854d0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T16:20:44Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f2d0d6d6-044e-4b70-919e-bf56920163cc","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:50646","PortSpecifier":{"PortValue":50646}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.50:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784910044,"nanos":833618518},"http":{"id":"f2d0d6d6-044e-4b70-919e-bf56920163cc","method":"POST","headers":{":authority":"e2e-shared-a-fafc28.apps.fcfd467d-eea8-41c6-9191-af8557b854d0.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-fafc28/rate-test-model-fafc28/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T16:20:44Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f2d0d6d6-044e-4b70-919e-bf56920163cc","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-6r56pItm2QfyGOQ5_KZG9vBens43K8vxLOdZHe0BXePXOHj87V2y8uEqkdXR"}
{"level":"debug","ts":"2026-07-24T16:20:44Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f2d0d6d6-044e-4b70-919e-bf56920163cc","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-fafc28.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-6r56pItm2QfyGOQ5_KZG9vBens43K8vxLOdZHe0BXePXOHj87V2y8uEqkdXR\"}"}
{"level":"debug","ts":"2026-07-24T16:20:44Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f2d0d6d6-044e-4b70-919e-bf56920163cc","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-fafc28.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"c3a2b8c4-bc52-4fc4-88bc-e8a9c8b5d420","keyName":"e2e-rate-a-d8b5a8","subscription":"e2e-rate-iso-a-d8b5a8","tenant":"e2e-shared-a-fafc28","userId":"c3a2b8c4-bc52-4fc4-88bc-e8a9c8b5d420","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T16:20:44Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f2d0d6d6-044e-4b70-919e-bf56920163cc","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-fafc28.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-fafc28/rate-test-model-fafc28\",\"requestedSubscription\":\"e2e-rate-iso-a-d8b5a8\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T16:20:44Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f2d0d6d6-044e-4b70-919e-bf56920163cc","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-fafc28.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-fafc28","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d8b5a8","namespace":"ai-tenant-e2e-shared-a-fafc28","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-fafc28/rate-test-model-fafc28"}}
{"level":"debug","ts":"2026-07-24T16:20:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f2d0d6d6-044e-4b70-919e-bf56920163cc","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T16:20:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f2d0d6d6-044e-4b70-919e-bf56920163cc","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:20:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f2d0d6d6-044e-4b70-919e-bf56920163cc","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:20:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f2d0d6d6-044e-4b70-919e-bf56920163cc","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-fafc28/rate-test-model-fafc28\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-fafc28/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:20:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f2d0d6d6-044e-4b70-919e-bf56920163cc","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:20:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f2d0d6d6-044e-4b70-919e-bf56920163cc","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T16:20:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f2d0d6d6-044e-4b70-919e-bf56920163cc","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T16:20:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f2d0d6d6-044e-4b70-919e-bf56920163cc","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-d8b5a8"}
{"level":"debug","ts":"2026-07-24T16:20:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f2d0d6d6-044e-4b70-919e-bf56920163cc","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"c3a2b8c4-bc52-4fc4-88bc-e8a9c8b5d420","keyName":"e2e-rate-a-d8b5a8","selected_subscription":"e2e-rate-iso-a-d8b5a8","selected_subscription_key":"ai-tenant-e2e-shared-a-fafc28/e2e-rate-iso-a-d8b5a8@ai-tenant-e2e-shared-a-fafc28/rate-test-model-fafc28","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-fafc28","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d8b5a8","namespace":"ai-tenant-e2e-shared-a-fafc28","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-fafc28/rate-test-model-fafc28"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T16:20:44Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f2d0d6d6-044e-4b70-919e-bf56920163cc","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T16:20:44Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f2d0d6d6-044e-4b70-919e-bf56920163cc","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T16:20:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"012f119b-d5c5-4eb5-b658-b983cfcac905","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:50658","PortSpecifier":{"PortValue":50658}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.50:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"012f119b-d5c5-4eb5-b658-b983cfcac905","method":"POST","path":"/ai-tenant-e2e-shared-a-fafc28/rate-test-model-fafc28/v1/completions","host":"e2e-shared-a-fafc28.apps.fcfd467d-eea8-41c6-9191-af8557b854d0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T16:20:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"012f119b-d5c5-4eb5-b658-b983cfcac905","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:50658","PortSpecifier":{"PortValue":50658}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.50:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784910045,"nanos":874191941},"http":{"id":"012f119b-d5c5-4eb5-b658-b983cfcac905","method":"POST","headers":{":authority":"e2e-shared-a-fafc28.apps.fcfd467d-eea8-41c6-9191-af8557b854d0.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-fafc28/rate-test-model-fafc28/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T16:20:45Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"012f119b-d5c5-4eb5-b658-b983cfcac905","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-6r56pItm2QfyGOQ5_KZG9vBens43K8vxLOdZHe0BXePXOHj87V2y8uEqkdXR"}
{"level":"debug","ts":"2026-07-24T16:20:45Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"012f119b-d5c5-4eb5-b658-b983cfcac905","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-fafc28.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-6r56pItm2QfyGOQ5_KZG9vBens43K8vxLOdZHe0BXePXOHj87V2y8uEqkdXR\"}"}
{"level":"debug","ts":"2026-07-24T16:20:45Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"012f119b-d5c5-4eb5-b658-b983cfcac905","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-fafc28.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"c3a2b8c4-bc52-4fc4-88bc-e8a9c8b5d420","keyName":"e2e-rate-a-d8b5a8","subscription":"e2e-rate-iso-a-d8b5a8","tenant":"e2e-shared-a-fafc28","userId":"c3a2b8c4-bc52-4fc4-88bc-e8a9c8b5d420","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T16:20:45Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"012f119b-d5c5-4eb5-b658-b983cfcac905","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-fafc28.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-fafc28/rate-test-model-fafc28\",\"requestedSubscription\":\"e2e-rate-iso-a-d8b5a8\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T16:20:45Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"012f119b-d5c5-4eb5-b658-b983cfcac905","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-fafc28.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-fafc28","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d8b5a8","namespace":"ai-tenant-e2e-shared-a-fafc28","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-fafc28/rate-test-model-fafc28"}}
{"level":"debug","ts":"2026-07-24T16:20:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"012f119b-d5c5-4eb5-b658-b983cfcac905","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T16:20:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"012f119b-d5c5-4eb5-b658-b983cfcac905","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:20:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"012f119b-d5c5-4eb5-b658-b983cfcac905","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-fafc28/rate-test-model-fafc28\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-fafc28/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:20:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"012f119b-d5c5-4eb5-b658-b983cfcac905","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:20:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"012f119b-d5c5-4eb5-b658-b983cfcac905","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:20:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"012f119b-d5c5-4eb5-b658-b983cfcac905","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-d8b5a8"}
{"level":"debug","ts":"2026-07-24T16:20:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"012f119b-d5c5-4eb5-b658-b983cfcac905","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T16:20:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"012f119b-d5c5-4eb5-b658-b983cfcac905","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T16:20:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"012f119b-d5c5-4eb5-b658-b983cfcac905","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"c3a2b8c4-bc52-4fc4-88bc-e8a9c8b5d420","keyName":"e2e-rate-a-d8b5a8","selected_subscription":"e2e-rate-iso-a-d8b5a8","selected_subscription_key":"ai-tenant-e2e-shared-a-fafc28/e2e-rate-iso-a-d8b5a8@ai-tenant-e2e-shared-a-fafc28/rate-test-model-fafc28","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-fafc28","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d8b5a8","namespace":"ai-tenant-e2e-shared-a-fafc28","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-fafc28/rate-test-model-fafc28"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T16:20:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"012f119b-d5c5-4eb5-b658-b983cfcac905","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T16:20:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"012f119b-d5c5-4eb5-b658-b983cfcac905","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T16:20:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"bc52b014-e615-4bf1-a2bb-82cc6538688b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:50672","PortSpecifier":{"PortValue":50672}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.50:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"bc52b014-e615-4bf1-a2bb-82cc6538688b","method":"POST","path":"/ai-tenant-e2e-shared-a-fafc28/rate-test-model-fafc28/v1/completions","host":"e2e-shared-a-fafc28.apps.fcfd467d-eea8-41c6-9191-af8557b854d0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T16:20:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"bc52b014-e615-4bf1-a2bb-82cc6538688b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:50672","PortSpecifier":{"PortValue":50672}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.50:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784910046,"nanos":912926838},"http":{"id":"bc52b014-e615-4bf1-a2bb-82cc6538688b","method":"POST","headers":{":authority":"e2e-shared-a-fafc28.apps.fcfd467d-eea8-41c6-9191-af8557b854d0.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-fafc28/rate-test-model-fafc28/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T16:20:46Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"bc52b014-e615-4bf1-a2bb-82cc6538688b","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-6r56pItm2QfyGOQ5_KZG9vBens43K8vxLOdZHe0BXePXOHj87V2y8uEqkdXR"}
{"level":"debug","ts":"2026-07-24T16:20:46Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"bc52b014-e615-4bf1-a2bb-82cc6538688b","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-fafc28.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-6r56pItm2QfyGOQ5_KZG9vBens43K8vxLOdZHe0BXePXOHj87V2y8uEqkdXR\"}"}
{"level":"debug","ts":"2026-07-24T16:20:46Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"bc52b014-e615-4bf1-a2bb-82cc6538688b","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-fafc28.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"c3a2b8c4-bc52-4fc4-88bc-e8a9c8b5d420","keyName":"e2e-rate-a-d8b5a8","subscription":"e2e-rate-iso-a-d8b5a8","tenant":"e2e-shared-a-fafc28","userId":"c3a2b8c4-bc52-4fc4-88bc-e8a9c8b5d420","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T16:20:46Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"bc52b014-e615-4bf1-a2bb-82cc6538688b","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-fafc28.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-fafc28/rate-test-model-fafc28\",\"requestedSubscription\":\"e2e-rate-iso-a-d8b5a8\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T16:20:46Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"bc52b014-e615-4bf1-a2bb-82cc6538688b","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-fafc28.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-fafc28","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d8b5a8","namespace":"ai-tenant-e2e-shared-a-fafc28","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-fafc28/rate-test-model-fafc28"}}
{"level":"debug","ts":"2026-07-24T16:20:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"bc52b014-e615-4bf1-a2bb-82cc6538688b","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T16:20:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bc52b014-e615-4bf1-a2bb-82cc6538688b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:20:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bc52b014-e615-4bf1-a2bb-82cc6538688b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:20:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bc52b014-e615-4bf1-a2bb-82cc6538688b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-fafc28/rate-test-model-fafc28\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-fafc28/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:20:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bc52b014-e615-4bf1-a2bb-82cc6538688b","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:20:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bc52b014-e615-4bf1-a2bb-82cc6538688b","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T16:20:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bc52b014-e615-4bf1-a2bb-82cc6538688b","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-d8b5a8"}
{"level":"debug","ts":"2026-07-24T16:20:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bc52b014-e615-4bf1-a2bb-82cc6538688b","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T16:20:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bc52b014-e615-4bf1-a2bb-82cc6538688b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"c3a2b8c4-bc52-4fc4-88bc-e8a9c8b5d420","keyName":"e2e-rate-a-d8b5a8","selected_subscription":"e2e-rate-iso-a-d8b5a8","selected_subscription_key":"ai-tenant-e2e-shared-a-fafc28/e2e-rate-iso-a-d8b5a8@ai-tenant-e2e-shared-a-fafc28/rate-test-model-fafc28","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-fafc28","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d8b5a8","namespace":"ai-tenant-e2e-shared-a-fafc28","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-fafc28/rate-test-model-fafc28"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T16:20:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"bc52b014-e615-4bf1-a2bb-82cc6538688b","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T16:20:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"bc52b014-e615-4bf1-a2bb-82cc6538688b","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T16:20:47Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"faa52b37-3489-4099-b627-349554d3df4d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:50680","PortSpecifier":{"PortValue":50680}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.50:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"faa52b37-3489-4099-b627-349554d3df4d","method":"POST","path":"/ai-tenant-e2e-shared-a-fafc28/rate-test-model-fafc28/v1/completions","host":"e2e-shared-a-fafc28.apps.fcfd467d-eea8-41c6-9191-af8557b854d0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T16:20:47Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"faa52b37-3489-4099-b627-349554d3df4d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:50680","PortSpecifier":{"PortValue":50680}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.50:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784910047,"nanos":952827288},"http":{"id":"faa52b37-3489-4099-b627-349554d3df4d","method":"POST","headers":{":authority":"e2e-shared-a-fafc28.apps.fcfd467d-eea8-41c6-9191-af8557b854d0.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-fafc28/rate-test-model-fafc28/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T16:20:47Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"faa52b37-3489-4099-b627-349554d3df4d","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-6r56pItm2QfyGOQ5_KZG9vBens43K8vxLOdZHe0BXePXOHj87V2y8uEqkdXR"}
{"level":"debug","ts":"2026-07-24T16:20:47Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"faa52b37-3489-4099-b627-349554d3df4d","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-fafc28.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-6r56pItm2QfyGOQ5_KZG9vBens43K8vxLOdZHe0BXePXOHj87V2y8uEqkdXR\"}"}
{"level":"debug","ts":"2026-07-24T16:20:47Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"faa52b37-3489-4099-b627-349554d3df4d","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-fafc28.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"c3a2b8c4-bc52-4fc4-88bc-e8a9c8b5d420","keyName":"e2e-rate-a-d8b5a8","subscription":"e2e-rate-iso-a-d8b5a8","tenant":"e2e-shared-a-fafc28","userId":"c3a2b8c4-bc52-4fc4-88bc-e8a9c8b5d420","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T16:20:47Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"faa52b37-3489-4099-b627-349554d3df4d","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-fafc28.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-fafc28/rate-test-model-fafc28\",\"requestedSubscription\":\"e2e-rate-iso-a-d8b5a8\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T16:20:47Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"faa52b37-3489-4099-b627-349554d3df4d","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-fafc28.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-fafc28","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d8b5a8","namespace":"ai-tenant-e2e-shared-a-fafc28","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-fafc28/rate-test-model-fafc28"}}
{"level":"debug","ts":"2026-07-24T16:20:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"faa52b37-3489-4099-b627-349554d3df4d","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T16:20:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"faa52b37-3489-4099-b627-349554d3df4d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:20:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"faa52b37-3489-4099-b627-349554d3df4d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:20:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"faa52b37-3489-4099-b627-349554d3df4d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-fafc28/rate-test-model-fafc28\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-fafc28/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:20:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"faa52b37-3489-4099-b627-349554d3df4d","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:20:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"faa52b37-3489-4099-b627-349554d3df4d","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T16:20:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"faa52b37-3489-4099-b627-349554d3df4d","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-d8b5a8"}
{"level":"debug","ts":"2026-07-24T16:20:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"faa52b37-3489-4099-b627-349554d3df4d","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T16:20:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"faa52b37-3489-4099-b627-349554d3df4d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"c3a2b8c4-bc52-4fc4-88bc-e8a9c8b5d420","keyName":"e2e-rate-a-d8b5a8","selected_subscription":"e2e-rate-iso-a-d8b5a8","selected_subscription_key":"ai-tenant-e2e-shared-a-fafc28/e2e-rate-iso-a-d8b5a8@ai-tenant-e2e-shared-a-fafc28/rate-test-model-fafc28","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-fafc28","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d8b5a8","namespace":"ai-tenant-e2e-shared-a-fafc28","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-fafc28/rate-test-model-fafc28"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T16:20:47Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"faa52b37-3489-4099-b627-349554d3df4d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T16:20:47Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"faa52b37-3489-4099-b627-349554d3df4d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T16:20:48Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e0b95afb-d382-46b2-90be-fe77391619bc","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:50688","PortSpecifier":{"PortValue":50688}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.50:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e0b95afb-d382-46b2-90be-fe77391619bc","method":"POST","path":"/ai-tenant-e2e-shared-a-fafc28/rate-test-model-fafc28/v1/completions","host":"e2e-shared-a-fafc28.apps.fcfd467d-eea8-41c6-9191-af8557b854d0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T16:20:48Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e0b95afb-d382-46b2-90be-fe77391619bc","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:50688","PortSpecifier":{"PortValue":50688}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.50:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784910048,"nanos":993555578},"http":{"id":"e0b95afb-d382-46b2-90be-fe77391619bc","method":"POST","headers":{":authority":"e2e-shared-a-fafc28.apps.fcfd467d-eea8-41c6-9191-af8557b854d0.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-fafc28/rate-test-model-fafc28/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T16:20:48Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e0b95afb-d382-46b2-90be-fe77391619bc","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-6r56pItm2QfyGOQ5_KZG9vBens43K8vxLOdZHe0BXePXOHj87V2y8uEqkdXR"}
{"level":"debug","ts":"2026-07-24T16:20:48Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e0b95afb-d382-46b2-90be-fe77391619bc","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-fafc28.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-6r56pItm2QfyGOQ5_KZG9vBens43K8vxLOdZHe0BXePXOHj87V2y8uEqkdXR\"}"}
{"level":"debug","ts":"2026-07-24T16:20:48Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e0b95afb-d382-46b2-90be-fe77391619bc","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-fafc28.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"c3a2b8c4-bc52-4fc4-88bc-e8a9c8b5d420","keyName":"e2e-rate-a-d8b5a8","subscription":"e2e-rate-iso-a-d8b5a8","tenant":"e2e-shared-a-fafc28","userId":"c3a2b8c4-bc52-4fc4-88bc-e8a9c8b5d420","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T16:20:48Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e0b95afb-d382-46b2-90be-fe77391619bc","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-fafc28.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-fafc28/rate-test-model-fafc28\",\"requestedSubscription\":\"e2e-rate-iso-a-d8b5a8\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T16:20:48Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e0b95afb-d382-46b2-90be-fe77391619bc","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-fafc28.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-fafc28","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d8b5a8","namespace":"ai-tenant-e2e-shared-a-fafc28","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-fafc28/rate-test-model-fafc28"}}
{"level":"debug","ts":"2026-07-24T16:20:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e0b95afb-d382-46b2-90be-fe77391619bc","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T16:20:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e0b95afb-d382-46b2-90be-fe77391619bc","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:20:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e0b95afb-d382-46b2-90be-fe77391619bc","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:20:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e0b95afb-d382-46b2-90be-fe77391619bc","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-fafc28/rate-test-model-fafc28\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-fafc28/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:20:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e0b95afb-d382-46b2-90be-fe77391619bc","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:20:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e0b95afb-d382-46b2-90be-fe77391619bc","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T16:20:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e0b95afb-d382-46b2-90be-fe77391619bc","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-d8b5a8"}
{"level":"debug","ts":"2026-07-24T16:20:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e0b95afb-d382-46b2-90be-fe77391619bc","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T16:20:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e0b95afb-d382-46b2-90be-fe77391619bc","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"c3a2b8c4-bc52-4fc4-88bc-e8a9c8b5d420","keyName":"e2e-rate-a-d8b5a8","selected_subscription":"e2e-rate-iso-a-d8b5a8","selected_subscription_key":"ai-tenant-e2e-shared-a-fafc28/e2e-rate-iso-a-d8b5a8@ai-tenant-e2e-shared-a-fafc28/rate-test-model-fafc28","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-fafc28","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d8b5a8","namespace":"ai-tenant-e2e-shared-a-fafc28","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-fafc28/rate-test-model-fafc28"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T16:20:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e0b95afb-d382-46b2-90be-fe77391619bc","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T16:20:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e0b95afb-d382-46b2-90be-fe77391619bc","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T16:20:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"53ab8f32-d755-402c-8c7e-2109050202f7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:50704","PortSpecifier":{"PortValue":50704}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.50:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"53ab8f32-d755-402c-8c7e-2109050202f7","method":"POST","path":"/ai-tenant-e2e-shared-a-fafc28/rate-test-model-fafc28/v1/completions","host":"e2e-shared-a-fafc28.apps.fcfd467d-eea8-41c6-9191-af8557b854d0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T16:20:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"53ab8f32-d755-402c-8c7e-2109050202f7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:50704","PortSpecifier":{"PortValue":50704}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.50:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784910050,"nanos":36755576},"http":{"id":"53ab8f32-d755-402c-8c7e-2109050202f7","method":"POST","headers":{":authority":"e2e-shared-a-fafc28.apps.fcfd467d-eea8-41c6-9191-af8557b854d0.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-fafc28/rate-test-model-fafc28/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T16:20:50Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"53ab8f32-d755-402c-8c7e-2109050202f7","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-6r56pItm2QfyGOQ5_KZG9vBens43K8vxLOdZHe0BXePXOHj87V2y8uEqkdXR"}
{"level":"debug","ts":"2026-07-24T16:20:50Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"53ab8f32-d755-402c-8c7e-2109050202f7","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-fafc28.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-6r56pItm2QfyGOQ5_KZG9vBens43K8vxLOdZHe0BXePXOHj87V2y8uEqkdXR\"}"}
{"level":"debug","ts":"2026-07-24T16:20:50Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"53ab8f32-d755-402c-8c7e-2109050202f7","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-fafc28.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"c3a2b8c4-bc52-4fc4-88bc-e8a9c8b5d420","keyName":"e2e-rate-a-d8b5a8","subscription":"e2e-rate-iso-a-d8b5a8","tenant":"e2e-shared-a-fafc28","userId":"c3a2b8c4-bc52-4fc4-88bc-e8a9c8b5d420","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T16:20:50Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"53ab8f32-d755-402c-8c7e-2109050202f7","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-fafc28.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-fafc28/rate-test-model-fafc28\",\"requestedSubscription\":\"e2e-rate-iso-a-d8b5a8\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T16:20:50Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"53ab8f32-d755-402c-8c7e-2109050202f7","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-fafc28.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-fafc28","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d8b5a8","namespace":"ai-tenant-e2e-shared-a-fafc28","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-fafc28/rate-test-model-fafc28"}}
{"level":"debug","ts":"2026-07-24T16:20:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"53ab8f32-d755-402c-8c7e-2109050202f7","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T16:20:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"53ab8f32-d755-402c-8c7e-2109050202f7","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:20:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"53ab8f32-d755-402c-8c7e-2109050202f7","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:20:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"53ab8f32-d755-402c-8c7e-2109050202f7","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:20:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"53ab8f32-d755-402c-8c7e-2109050202f7","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-fafc28/rate-test-model-fafc28\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-fafc28/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:20:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"53ab8f32-d755-402c-8c7e-2109050202f7","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T16:20:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"53ab8f32-d755-402c-8c7e-2109050202f7","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-d8b5a8"}
{"level":"debug","ts":"2026-07-24T16:20:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"53ab8f32-d755-402c-8c7e-2109050202f7","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T16:20:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"53ab8f32-d755-402c-8c7e-2109050202f7","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"c3a2b8c4-bc52-4fc4-88bc-e8a9c8b5d420","keyName":"e2e-rate-a-d8b5a8","selected_subscription":"e2e-rate-iso-a-d8b5a8","selected_subscription_key":"ai-tenant-e2e-shared-a-fafc28/e2e-rate-iso-a-d8b5a8@ai-tenant-e2e-shared-a-fafc28/rate-test-model-fafc28","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-fafc28","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d8b5a8","namespace":"ai-tenant-e2e-shared-a-fafc28","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-fafc28/rate-test-model-fafc28"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T16:20:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"53ab8f32-d755-402c-8c7e-2109050202f7","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T16:20:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"53ab8f32-d755-402c-8c7e-2109050202f7","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T16:20:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"27073627-70fd-4808-a261-360aeba4609d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:50710","PortSpecifier":{"PortValue":50710}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.50:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"27073627-70fd-4808-a261-360aeba4609d","method":"POST","path":"/ai-tenant-e2e-shared-a-fafc28/rate-test-model-fafc28/v1/completions","host":"e2e-shared-a-fafc28.apps.fcfd467d-eea8-41c6-9191-af8557b854d0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T16:20:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"27073627-70fd-4808-a261-360aeba4609d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:50710","PortSpecifier":{"PortValue":50710}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.50:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784910051,"nanos":79776450},"http":{"id":"27073627-70fd-4808-a261-360aeba4609d","method":"POST","headers":{":authority":"e2e-shared-a-fafc28.apps.fcfd467d-eea8-41c6-9191-af8557b854d0.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-fafc28/rate-test-model-fafc28/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T16:20:51Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"27073627-70fd-4808-a261-360aeba4609d","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-6r56pItm2QfyGOQ5_KZG9vBens43K8vxLOdZHe0BXePXOHj87V2y8uEqkdXR"}
{"level":"debug","ts":"2026-07-24T16:20:51Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"27073627-70fd-4808-a261-360aeba4609d","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-fafc28.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-6r56pItm2QfyGOQ5_KZG9vBens43K8vxLOdZHe0BXePXOHj87V2y8uEqkdXR\"}"}
{"level":"debug","ts":"2026-07-24T16:20:51Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"27073627-70fd-4808-a261-360aeba4609d","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-fafc28.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"c3a2b8c4-bc52-4fc4-88bc-e8a9c8b5d420","keyName":"e2e-rate-a-d8b5a8","subscription":"e2e-rate-iso-a-d8b5a8","tenant":"e2e-shared-a-fafc28","userId":"c3a2b8c4-bc52-4fc4-88bc-e8a9c8b5d420","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T16:20:51Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"27073627-70fd-4808-a261-360aeba4609d","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-fafc28.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-fafc28/rate-test-model-fafc28\",\"requestedSubscription\":\"e2e-rate-iso-a-d8b5a8\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T16:20:51Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"27073627-70fd-4808-a261-360aeba4609d","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-fafc28.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-fafc28","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d8b5a8","namespace":"ai-tenant-e2e-shared-a-fafc28","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-fafc28/rate-test-model-fafc28"}}
{"level":"debug","ts":"2026-07-24T16:20:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"27073627-70fd-4808-a261-360aeba4609d","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T16:20:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"27073627-70fd-4808-a261-360aeba4609d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:20:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"27073627-70fd-4808-a261-360aeba4609d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:20:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"27073627-70fd-4808-a261-360aeba4609d","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:20:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"27073627-70fd-4808-a261-360aeba4609d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-fafc28/rate-test-model-fafc28\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-fafc28/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:20:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"27073627-70fd-4808-a261-360aeba4609d","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T16:20:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"27073627-70fd-4808-a261-360aeba4609d","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T16:20:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"27073627-70fd-4808-a261-360aeba4609d","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-d8b5a8"}
{"level":"debug","ts":"2026-07-24T16:20:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"27073627-70fd-4808-a261-360aeba4609d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"c3a2b8c4-bc52-4fc4-88bc-e8a9c8b5d420","keyName":"e2e-rate-a-d8b5a8","selected_subscription":"e2e-rate-iso-a-d8b5a8","selected_subscription_key":"ai-tenant-e2e-shared-a-fafc28/e2e-rate-iso-a-d8b5a8@ai-tenant-e2e-shared-a-fafc28/rate-test-model-fafc28","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-fafc28","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d8b5a8","namespace":"ai-tenant-e2e-shared-a-fafc28","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-fafc28/rate-test-model-fafc28"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T16:20:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"27073627-70fd-4808-a261-360aeba4609d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T16:20:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"27073627-70fd-4808-a261-360aeba4609d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T16:20:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7fa207cd-50ea-4cd4-9e57-7e3072571230","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:50044","PortSpecifier":{"PortValue":50044}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"7fa207cd-50ea-4cd4-9e57-7e3072571230","method":"POST","path":"/ai-tenant-e2e-shared-b-c6c91e/rate-test-model-c6c91e/v1/completions","host":"e2e-shared-b-c6c91e.apps.fcfd467d-eea8-41c6-9191-af8557b854d0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T16:20:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7fa207cd-50ea-4cd4-9e57-7e3072571230","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:50044","PortSpecifier":{"PortValue":50044}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784910051,"nanos":122370387},"http":{"id":"7fa207cd-50ea-4cd4-9e57-7e3072571230","method":"POST","headers":{":authority":"e2e-shared-b-c6c91e.apps.fcfd467d-eea8-41c6-9191-af8557b854d0.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-c6c91e/rate-test-model-c6c91e/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T16:20:51Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"7fa207cd-50ea-4cd4-9e57-7e3072571230","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-v1zSonUJSD47k4y3_1jo0OQWDLK0H6MMXhEEoXS2u5ZEMd5U4YOUag8YPLGb"}
{"level":"debug","ts":"2026-07-24T16:20:51Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"7fa207cd-50ea-4cd4-9e57-7e3072571230","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-c6c91e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-v1zSonUJSD47k4y3_1jo0OQWDLK0H6MMXhEEoXS2u5ZEMd5U4YOUag8YPLGb\"}"}
{"level":"debug","ts":"2026-07-24T16:20:51Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"7fa207cd-50ea-4cd4-9e57-7e3072571230","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-c6c91e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"3131a1e5-ded1-4c52-9d8c-42569300f1f3","keyName":"e2e-rate-b-d8b5a8","subscription":"e2e-rate-iso-b-d8b5a8","tenant":"e2e-shared-b-c6c91e","userId":"3131a1e5-ded1-4c52-9d8c-42569300f1f3","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T16:20:51Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"7fa207cd-50ea-4cd4-9e57-7e3072571230","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-c6c91e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-c6c91e/rate-test-model-c6c91e\",\"requestedSubscription\":\"e2e-rate-iso-b-d8b5a8\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T16:20:51Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"7fa207cd-50ea-4cd4-9e57-7e3072571230","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-c6c91e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-c6c91e","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-d8b5a8","namespace":"ai-tenant-e2e-shared-b-c6c91e","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-b-c6c91e/rate-test-model-c6c91e"}}
{"level":"debug","ts":"2026-07-24T16:20:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"7fa207cd-50ea-4cd4-9e57-7e3072571230","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T16:20:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7fa207cd-50ea-4cd4-9e57-7e3072571230","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:20:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7fa207cd-50ea-4cd4-9e57-7e3072571230","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:20:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7fa207cd-50ea-4cd4-9e57-7e3072571230","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:20:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7fa207cd-50ea-4cd4-9e57-7e3072571230","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-c6c91e/rate-test-model-c6c91e\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-c6c91e/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:20:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7fa207cd-50ea-4cd4-9e57-7e3072571230","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T16:20:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7fa207cd-50ea-4cd4-9e57-7e3072571230","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T16:20:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7fa207cd-50ea-4cd4-9e57-7e3072571230","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-d8b5a8"}
{"level":"debug","ts":"2026-07-24T16:20:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7fa207cd-50ea-4cd4-9e57-7e3072571230","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"3131a1e5-ded1-4c52-9d8c-42569300f1f3","keyName":"e2e-rate-b-d8b5a8","selected_subscription":"e2e-rate-iso-b-d8b5a8","selected_subscription_key":"ai-tenant-e2e-shared-b-c6c91e/e2e-rate-iso-b-d8b5a8@ai-tenant-e2e-shared-b-c6c91e/rate-test-model-c6c91e","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-c6c91e","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-d8b5a8","namespace":"ai-tenant-e2e-shared-b-c6c91e","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-b-c6c91e/rate-test-model-c6c91e"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T16:20:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7fa207cd-50ea-4cd4-9e57-7e3072571230","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T16:20:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7fa207cd-50ea-4cd4-9e57-7e3072571230","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T16:20:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/339f0a2fbeab235cc589085bedc541c22553151d22d19d8b6a5436b542f7e687"}
{"level":"info","ts":"2026-07-24T16:20:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3e4c6080cecede2207c1929a03e00bfc75c545072d5b3e86da896540fb6f0b48"}
{"level":"info","ts":"2026-07-24T16:21:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c6e7371461f47256f58b4d0277d4285ff08bb525d0fbf8c2c94bd9f4b5d332ce"}
{"level":"info","ts":"2026-07-24T16:21:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f9dc8a43f9417e80a7c78f7425ce09e59bbef9fb8498a15691747f0913d8066a"}
{"level":"info","ts":"2026-07-24T16:21:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3abfe89bf1782f6d293f9229f5dc2a5bd9a079408fbc7aa30e2e2fc5540c31cf"}
{"level":"info","ts":"2026-07-24T16:21:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b2154d924282b4112ffafbf6ff9bf4d188f26f5729b81ad9313a7441cb54d885"}
{"level":"info","ts":"2026-07-24T16:21:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/482b4517be8dd8d7a3a74bfe163181cb996f529db136001b76125b9815d674a2"}
{"level":"info","ts":"2026-07-24T16:21:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/5af9c0656b9822955e66f144b0a3c08cc10ff0703f5dc860509a460a937b5f17"}
{"level":"info","ts":"2026-07-24T16:21:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ad13bf13983cb32725df22947811684c4e01c35f90c764c5380995343bcadf01"}
{"level":"info","ts":"2026-07-24T16:21:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/01d767e16e7ecf3095ab48f3fd38145316a2f9579deceda0fc5f16fde0f152d8"}
{"level":"info","ts":"2026-07-24T16:21:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3c3b11283439a68444fa3cf62071ceb5e36a0164531e522bc83cb36e72a16d45"}
{"level":"info","ts":"2026-07-24T16:21:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f09db7c537eb00acd222254ac088977ba374dc0c140ce76e419c868284015024"}
{"level":"info","ts":"2026-07-24T16:21:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3feaa4c61f632f7ae3b909f7803e992b9a91193d02ac0a49bddedb28bab23118"}
{"level":"info","ts":"2026-07-24T16:21:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1cd122c667dce6b1512cb9c0ba122ec2c53662d8f0f604c0d84231aa8235197a"}
{"level":"info","ts":"2026-07-24T16:21:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7bff0f43555d7e8ad1d1e01716d5170b077f95fb7c551318a1ee2f5f917145db"}
{"level":"info","ts":"2026-07-24T16:21:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c0863077d5447e723b5a9db9f4887016a1098fe1b4b5cc7bd6e366a9814c33c6"}
{"level":"info","ts":"2026-07-24T16:21:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/83871f332d08f85fb920ace55f1deca2a59c4d2c656da180e3b94bb2555b32dc"}
{"level":"info","ts":"2026-07-24T16:21:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/5f83723935cfda9f7369ed54dc40a24043cf4b39569bd5e55097d12cd221f134"}
{"level":"info","ts":"2026-07-24T16:21:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/33d11462faab55b3516aeffe34ce546df52da55cf024307b7415ee8a60e2b6ed"}
{"level":"info","ts":"2026-07-24T16:21:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/8881c13474f81592a36a574471d40a13c212e7017ce558545cbba20e776f2787"}
{"level":"info","ts":"2026-07-24T16:21:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/83c59eb3611e84dfaf5728b452d87e80d9cb9264be64f3976f4e57ac33062dab"}
{"level":"info","ts":"2026-07-24T16:21:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/35a01c1ebc302e587e1955b429222ac555d375658c93c45f6dda8bea4280d8ca"}
{"level":"info","ts":"2026-07-24T16:21:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/14a8944a58a487522fed17c05014db7bf17b8cca6fde22f5303b1a97f552abeb"}
{"level":"info","ts":"2026-07-24T16:21:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e09d9ccfb6fa3fce841947e1b43647be50d50cd8b08ee8ab5de2330b92f54305"}
{"level":"info","ts":"2026-07-24T16:21:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e10ac06e-5fa0-4900-8b8b-dba013b41814","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:49898","PortSpecifier":{"PortValue":49898}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e10ac06e-5fa0-4900-8b8b-dba013b41814","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.fcfd467d-eea8-41c6-9191-af8557b854d0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T16:21:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e10ac06e-5fa0-4900-8b8b-dba013b41814","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:49898","PortSpecifier":{"PortValue":49898}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784910115,"nanos":571265582},"http":{"id":"e10ac06e-5fa0-4900-8b8b-dba013b41814","method":"POST","headers":{":authority":"maas.apps.fcfd467d-eea8-41c6-9191-af8557b854d0.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T16:21:55Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"e10ac06e-5fa0-4900-8b8b-dba013b41814","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-24T16:21:55Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e10ac06e-5fa0-4900-8b8b-dba013b41814","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"cfa92684-529a-4738-904f-2f855e0bf7d0","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=674fb2f7-2bd8-4cd9-8782-38d631eb1bc5"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/af8557b854d0"]}}
{"level":"debug","ts":"2026-07-24T16:21:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e10ac06e-5fa0-4900-8b8b-dba013b41814","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/af8557b854d0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=674fb2f7-2bd8-4cd9-8782-38d631eb1bc5"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"cfa92684-529a-4738-904f-2f855e0bf7d0","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.fcfd467d-eea8-41c6-9191-af8557b854d0.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T16:21:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e10ac06e-5fa0-4900-8b8b-dba013b41814","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:21:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e10ac06e-5fa0-4900-8b8b-dba013b41814","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:21:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e10ac06e-5fa0-4900-8b8b-dba013b41814","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]},\"publishers/llm/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/llm/models/facebook/opt-125m-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:21:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"e10ac06e-5fa0-4900-8b8b-dba013b41814","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-24T16:21:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e10ac06e-5fa0-4900-8b8b-dba013b41814","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T16:21:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e10ac06e-5fa0-4900-8b8b-dba013b41814","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-24T16:21:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e10ac06e-5fa0-4900-8b8b-dba013b41814","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T16:21:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e10ac06e-5fa0-4900-8b8b-dba013b41814","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T16:21:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f8614c0a-d2c9-468c-8b00-6c4e57da925d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:49912","PortSpecifier":{"PortValue":49912}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f8614c0a-d2c9-468c-8b00-6c4e57da925d","method":"POST","path":"/llm/facebook-opt-125m-simulated/v1/chat/completions","host":"maas.apps.fcfd467d-eea8-41c6-9191-af8557b854d0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T16:21:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f8614c0a-d2c9-468c-8b00-6c4e57da925d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:49912","PortSpecifier":{"PortValue":49912}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784910115,"nanos":626854165},"http":{"id":"f8614c0a-d2c9-468c-8b00-6c4e57da925d","method":"POST","headers":{":authority":"maas.apps.fcfd467d-eea8-41c6-9191-af8557b854d0.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T16:21:55Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f8614c0a-d2c9-468c-8b00-6c4e57da925d","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-ng1Y4Lg3CV7y3SZw_gGWZpH0rvB6Osg3Bu1EBPMCRdcSom2Bie1AAYCHCmyO"}
{"level":"debug","ts":"2026-07-24T16:21:55Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f8614c0a-d2c9-468c-8b00-6c4e57da925d","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-ng1Y4Lg3CV7y3SZw_gGWZpH0rvB6Osg3Bu1EBPMCRdcSom2Bie1AAYCHCmyO\"}"}
{"level":"debug","ts":"2026-07-24T16:21:55Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f8614c0a-d2c9-468c-8b00-6c4e57da925d","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"aeaa8643-b08a-4121-aa91-e998db4e800f","keyName":"e2e-ipp-default","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"aeaa8643-b08a-4121-aa91-e998db4e800f","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T16:21:55Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f8614c0a-d2c9-468c-8b00-6c4e57da925d","config":"subscription-info","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"simulator-subscription\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T16:21:55Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f8614c0a-d2c9-468c-8b00-6c4e57da925d","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true,"resolvedModel":"llm/facebook-opt-125m-simulated"}}
{"level":"debug","ts":"2026-07-24T16:21:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f8614c0a-d2c9-468c-8b00-6c4e57da925d","input":{"auth":{"identity":"Bearer **** subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true,"resolvedModel":"llm/facebook-opt-125m-simulated"}}},"context":{"context_extensions":{"host":"311b1be286674fd5684c9ac59b318287dade9769cfe4aeebd8c88e2dc6b72418"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.fcfd467d-eea8-41c6-9191-af8557b854d0.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T16:21:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f8614c0a-d2c9-468c-8b00-6c4e57da925d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:21:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f8614c0a-d2c9-468c-8b00-6c4e57da925d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:21:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f8614c0a-d2c9-468c-8b00-6c4e57da925d","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:21:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f8614c0a-d2c9-468c-8b00-6c4e57da925d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]},\"publishers/llm/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/llm/models/facebook/opt-125m-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:21:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f8614c0a-d2c9-468c-8b00-6c4e57da925d","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T16:21:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f8614c0a-d2c9-468c-8b00-6c4e57da925d","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T16:21:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f8614c0a-d2c9-468c-8b00-6c4e57da925d","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-24T16:21:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f8614c0a-d2c9-468c-8b00-6c4e57da925d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"aeaa8643-b08a-4121-aa91-e998db4e800f","keyName":"e2e-ipp-default","selected_subscription":"simulator-subscription","selected_subscription_key":"models-as-a-service/simulator-subscription@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true,"resolvedModel":"llm/facebook-opt-125m-simulated"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T16:21:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f8614c0a-d2c9-468c-8b00-6c4e57da925d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T16:21:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f8614c0a-d2c9-468c-8b00-6c4e57da925d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T16:22:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ff213b8c7217bdb6037debc15f8716fc7508a12d1c68a5c178ea3706088196d0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T16:22:28Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T16:22:28Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:22:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ff213b8c7217bdb6037debc15f8716fc7508a12d1c68a5c178ea3706088196d0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:22:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ff213b8c7217bdb6037debc15f8716fc7508a12d1c68a5c178ea3706088196d0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:22:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ff213b8c7217bdb6037debc15f8716fc7508a12d1c68a5c178ea3706088196d0","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T16:22:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ff213b8c7217bdb6037debc15f8716fc7508a12d1c68a5c178ea3706088196d0"}
{"level":"debug","ts":"2026-07-24T16:22:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ff213b8c7217bdb6037debc15f8716fc7508a12d1c68a5c178ea3706088196d0","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T16:22:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ff213b8c7217bdb6037debc15f8716fc7508a12d1c68a5c178ea3706088196d0"}
{"level":"debug","ts":"2026-07-24T16:22:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ff213b8c7217bdb6037debc15f8716fc7508a12d1c68a5c178ea3706088196d0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T16:22:28Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T16:22:28Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ff213b8c7217bdb6037debc15f8716fc7508a12d1c68a5c178ea3706088196d0"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:22:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ff213b8c7217bdb6037debc15f8716fc7508a12d1c68a5c178ea3706088196d0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:22:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ff213b8c7217bdb6037debc15f8716fc7508a12d1c68a5c178ea3706088196d0","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T16:22:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ff213b8c7217bdb6037debc15f8716fc7508a12d1c68a5c178ea3706088196d0"}
{"level":"debug","ts":"2026-07-24T16:22:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2fc6c3a226fd177d9996a1c7ef93c41306a5938dc8efd68cddd6eda9eeae6235","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T16:22:28Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T16:22:28Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:22:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2fc6c3a226fd177d9996a1c7ef93c41306a5938dc8efd68cddd6eda9eeae6235","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:22:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2fc6c3a226fd177d9996a1c7ef93c41306a5938dc8efd68cddd6eda9eeae6235","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:22:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2fc6c3a226fd177d9996a1c7ef93c41306a5938dc8efd68cddd6eda9eeae6235","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T16:22:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2fc6c3a226fd177d9996a1c7ef93c41306a5938dc8efd68cddd6eda9eeae6235"}
{"level":"debug","ts":"2026-07-24T16:22:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2fc6c3a226fd177d9996a1c7ef93c41306a5938dc8efd68cddd6eda9eeae6235","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T16:22:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2fc6c3a226fd177d9996a1c7ef93c41306a5938dc8efd68cddd6eda9eeae6235"}
{"level":"debug","ts":"2026-07-24T16:22:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2fc6c3a226fd177d9996a1c7ef93c41306a5938dc8efd68cddd6eda9eeae6235","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T16:22:28Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T16:22:28Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["2fc6c3a226fd177d9996a1c7ef93c41306a5938dc8efd68cddd6eda9eeae6235"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:22:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2fc6c3a226fd177d9996a1c7ef93c41306a5938dc8efd68cddd6eda9eeae6235","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:22:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2fc6c3a226fd177d9996a1c7ef93c41306a5938dc8efd68cddd6eda9eeae6235","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T16:22:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2fc6c3a226fd177d9996a1c7ef93c41306a5938dc8efd68cddd6eda9eeae6235"}
{"level":"debug","ts":"2026-07-24T16:22:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"54b64547a9e31d48828647b30a79bf622bee2641e0a135172d2561049e93595a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T16:22:28Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T16:22:28Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:22:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"54b64547a9e31d48828647b30a79bf622bee2641e0a135172d2561049e93595a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:22:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"54b64547a9e31d48828647b30a79bf622bee2641e0a135172d2561049e93595a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:22:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"54b64547a9e31d48828647b30a79bf622bee2641e0a135172d2561049e93595a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T16:22:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/54b64547a9e31d48828647b30a79bf622bee2641e0a135172d2561049e93595a"}
{"level":"debug","ts":"2026-07-24T16:22:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"54b64547a9e31d48828647b30a79bf622bee2641e0a135172d2561049e93595a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T16:22:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/54b64547a9e31d48828647b30a79bf622bee2641e0a135172d2561049e93595a"}
{"level":"debug","ts":"2026-07-24T16:22:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"54b64547a9e31d48828647b30a79bf622bee2641e0a135172d2561049e93595a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T16:22:28Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T16:22:28Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["54b64547a9e31d48828647b30a79bf622bee2641e0a135172d2561049e93595a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:22:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"54b64547a9e31d48828647b30a79bf622bee2641e0a135172d2561049e93595a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:22:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"54b64547a9e31d48828647b30a79bf622bee2641e0a135172d2561049e93595a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T16:22:28Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T16:22:28Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:22:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"54b64547a9e31d48828647b30a79bf622bee2641e0a135172d2561049e93595a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:22:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"acf40084ba9f293aef0670e847b9cb56e73d25f620415698b310c6e0d1e89e09","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T16:22:28Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T16:22:28Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:22:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/54b64547a9e31d48828647b30a79bf622bee2641e0a135172d2561049e93595a"}
{"level":"info","ts":"2026-07-24T16:22:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"acf40084ba9f293aef0670e847b9cb56e73d25f620415698b310c6e0d1e89e09","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:22:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"54b64547a9e31d48828647b30a79bf622bee2641e0a135172d2561049e93595a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T16:22:28Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T16:22:28Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["54b64547a9e31d48828647b30a79bf622bee2641e0a135172d2561049e93595a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:22:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"54b64547a9e31d48828647b30a79bf622bee2641e0a135172d2561049e93595a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:22:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"acf40084ba9f293aef0670e847b9cb56e73d25f620415698b310c6e0d1e89e09","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T16:22:28Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T16:22:28Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:22:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/acf40084ba9f293aef0670e847b9cb56e73d25f620415698b310c6e0d1e89e09"}
{"level":"info","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"acf40084ba9f293aef0670e847b9cb56e73d25f620415698b310c6e0d1e89e09","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"54b64547a9e31d48828647b30a79bf622bee2641e0a135172d2561049e93595a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T16:22:29Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T16:22:29Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"54b64547a9e31d48828647b30a79bf622bee2641e0a135172d2561049e93595a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"acf40084ba9f293aef0670e847b9cb56e73d25f620415698b310c6e0d1e89e09","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T16:22:29Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T16:22:29Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["acf40084ba9f293aef0670e847b9cb56e73d25f620415698b310c6e0d1e89e09"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/54b64547a9e31d48828647b30a79bf622bee2641e0a135172d2561049e93595a"}
{"level":"info","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"acf40084ba9f293aef0670e847b9cb56e73d25f620415698b310c6e0d1e89e09","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"54b64547a9e31d48828647b30a79bf622bee2641e0a135172d2561049e93595a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T16:22:29Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T16:22:29Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["54b64547a9e31d48828647b30a79bf622bee2641e0a135172d2561049e93595a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/acf40084ba9f293aef0670e847b9cb56e73d25f620415698b310c6e0d1e89e09"}
{"level":"info","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"54b64547a9e31d48828647b30a79bf622bee2641e0a135172d2561049e93595a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"acf40084ba9f293aef0670e847b9cb56e73d25f620415698b310c6e0d1e89e09","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"54b64547a9e31d48828647b30a79bf622bee2641e0a135172d2561049e93595a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T16:22:29Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T16:22:29Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"54b64547a9e31d48828647b30a79bf622bee2641e0a135172d2561049e93595a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8ae59eb60456e45339cc055e658765d174ea8160aabcaeb88e6e5b08c9652f2c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T16:22:29Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T16:22:29Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/54b64547a9e31d48828647b30a79bf622bee2641e0a135172d2561049e93595a"}
{"level":"info","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8ae59eb60456e45339cc055e658765d174ea8160aabcaeb88e6e5b08c9652f2c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"54b64547a9e31d48828647b30a79bf622bee2641e0a135172d2561049e93595a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T16:22:29Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T16:22:29Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["54b64547a9e31d48828647b30a79bf622bee2641e0a135172d2561049e93595a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"54b64547a9e31d48828647b30a79bf622bee2641e0a135172d2561049e93595a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8ae59eb60456e45339cc055e658765d174ea8160aabcaeb88e6e5b08c9652f2c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"54b64547a9e31d48828647b30a79bf622bee2641e0a135172d2561049e93595a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/acf40084ba9f293aef0670e847b9cb56e73d25f620415698b310c6e0d1e89e09"}
{"level":"debug","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8ae59eb60456e45339cc055e658765d174ea8160aabcaeb88e6e5b08c9652f2c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T16:22:29Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T16:22:29Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8ae59eb60456e45339cc055e658765d174ea8160aabcaeb88e6e5b08c9652f2c"}
{"level":"info","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8ae59eb60456e45339cc055e658765d174ea8160aabcaeb88e6e5b08c9652f2c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8ae59eb60456e45339cc055e658765d174ea8160aabcaeb88e6e5b08c9652f2c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T16:22:29Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T16:22:29Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8ae59eb60456e45339cc055e658765d174ea8160aabcaeb88e6e5b08c9652f2c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8ae59eb60456e45339cc055e658765d174ea8160aabcaeb88e6e5b08c9652f2c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8ae59eb60456e45339cc055e658765d174ea8160aabcaeb88e6e5b08c9652f2c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T16:22:29Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T16:22:29Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8ae59eb60456e45339cc055e658765d174ea8160aabcaeb88e6e5b08c9652f2c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/54b64547a9e31d48828647b30a79bf622bee2641e0a135172d2561049e93595a"}
{"level":"error","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"8ae59eb60456e45339cc055e658765d174ea8160aabcaeb88e6e5b08c9652f2c","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"8ae59eb60456e45339cc055e658765d174ea8160aabcaeb88e6e5b08c9652f2c\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8ae59eb60456e45339cc055e658765d174ea8160aabcaeb88e6e5b08c9652f2c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T16:22:29Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T16:22:29Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8ae59eb60456e45339cc055e658765d174ea8160aabcaeb88e6e5b08c9652f2c"}
{"level":"info","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8ae59eb60456e45339cc055e658765d174ea8160aabcaeb88e6e5b08c9652f2c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5b75436bca2409b4bfa07525415b986aeb7e26b33e5b30a7012fb6fcd348f405","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T16:22:29Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T16:22:29Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5b75436bca2409b4bfa07525415b986aeb7e26b33e5b30a7012fb6fcd348f405","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8ae59eb60456e45339cc055e658765d174ea8160aabcaeb88e6e5b08c9652f2c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T16:22:29Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T16:22:29Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8ae59eb60456e45339cc055e658765d174ea8160aabcaeb88e6e5b08c9652f2c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5b75436bca2409b4bfa07525415b986aeb7e26b33e5b30a7012fb6fcd348f405"}
{"level":"info","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8ae59eb60456e45339cc055e658765d174ea8160aabcaeb88e6e5b08c9652f2c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5b75436bca2409b4bfa07525415b986aeb7e26b33e5b30a7012fb6fcd348f405","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T16:22:29Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T16:22:29Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["5b75436bca2409b4bfa07525415b986aeb7e26b33e5b30a7012fb6fcd348f405"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8ae59eb60456e45339cc055e658765d174ea8160aabcaeb88e6e5b08c9652f2c"}
{"level":"info","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5b75436bca2409b4bfa07525415b986aeb7e26b33e5b30a7012fb6fcd348f405","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8ae59eb60456e45339cc055e658765d174ea8160aabcaeb88e6e5b08c9652f2c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5b75436bca2409b4bfa07525415b986aeb7e26b33e5b30a7012fb6fcd348f405","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T16:22:29Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T16:22:29Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5b75436bca2409b4bfa07525415b986aeb7e26b33e5b30a7012fb6fcd348f405","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5b75436bca2409b4bfa07525415b986aeb7e26b33e5b30a7012fb6fcd348f405","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5b75436bca2409b4bfa07525415b986aeb7e26b33e5b30a7012fb6fcd348f405"}
{"level":"debug","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5b75436bca2409b4bfa07525415b986aeb7e26b33e5b30a7012fb6fcd348f405","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T16:22:29Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T16:22:29Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["5b75436bca2409b4bfa07525415b986aeb7e26b33e5b30a7012fb6fcd348f405"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5b75436bca2409b4bfa07525415b986aeb7e26b33e5b30a7012fb6fcd348f405","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5b75436bca2409b4bfa07525415b986aeb7e26b33e5b30a7012fb6fcd348f405","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8ae59eb60456e45339cc055e658765d174ea8160aabcaeb88e6e5b08c9652f2c"}
{"level":"debug","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d0ee3e072bdbbb2cd60869d621dbd0730024094c2595f2245c00de04faf2ed86","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T16:22:29Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T16:22:29Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d0ee3e072bdbbb2cd60869d621dbd0730024094c2595f2245c00de04faf2ed86","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d0ee3e072bdbbb2cd60869d621dbd0730024094c2595f2245c00de04faf2ed86","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5b75436bca2409b4bfa07525415b986aeb7e26b33e5b30a7012fb6fcd348f405"}
{"level":"debug","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d0ee3e072bdbbb2cd60869d621dbd0730024094c2595f2245c00de04faf2ed86","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T16:22:29Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T16:22:29Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d0ee3e072bdbbb2cd60869d621dbd0730024094c2595f2245c00de04faf2ed86","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d0ee3e072bdbbb2cd60869d621dbd0730024094c2595f2245c00de04faf2ed86","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d0ee3e072bdbbb2cd60869d621dbd0730024094c2595f2245c00de04faf2ed86"}
{"level":"debug","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d0ee3e072bdbbb2cd60869d621dbd0730024094c2595f2245c00de04faf2ed86","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d0ee3e072bdbbb2cd60869d621dbd0730024094c2595f2245c00de04faf2ed86"}
{"level":"debug","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d0ee3e072bdbbb2cd60869d621dbd0730024094c2595f2245c00de04faf2ed86","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T16:22:29Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T16:22:29Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d0ee3e072bdbbb2cd60869d621dbd0730024094c2595f2245c00de04faf2ed86"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d0ee3e072bdbbb2cd60869d621dbd0730024094c2595f2245c00de04faf2ed86","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d0ee3e072bdbbb2cd60869d621dbd0730024094c2595f2245c00de04faf2ed86","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d0ee3e072bdbbb2cd60869d621dbd0730024094c2595f2245c00de04faf2ed86"}
{"level":"debug","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"73ccfaaa5699f2c9d8bf8a6308a4662be4366e5d560f9b385778681991ac132b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T16:22:29Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T16:22:29Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"73ccfaaa5699f2c9d8bf8a6308a4662be4366e5d560f9b385778681991ac132b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"73ccfaaa5699f2c9d8bf8a6308a4662be4366e5d560f9b385778681991ac132b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"73ccfaaa5699f2c9d8bf8a6308a4662be4366e5d560f9b385778681991ac132b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/73ccfaaa5699f2c9d8bf8a6308a4662be4366e5d560f9b385778681991ac132b"}
{"level":"debug","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"73ccfaaa5699f2c9d8bf8a6308a4662be4366e5d560f9b385778681991ac132b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/73ccfaaa5699f2c9d8bf8a6308a4662be4366e5d560f9b385778681991ac132b"}
{"level":"debug","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"73ccfaaa5699f2c9d8bf8a6308a4662be4366e5d560f9b385778681991ac132b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T16:22:29Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T16:22:29Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["73ccfaaa5699f2c9d8bf8a6308a4662be4366e5d560f9b385778681991ac132b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"73ccfaaa5699f2c9d8bf8a6308a4662be4366e5d560f9b385778681991ac132b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"73ccfaaa5699f2c9d8bf8a6308a4662be4366e5d560f9b385778681991ac132b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T16:22:29Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T16:22:29Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"73ccfaaa5699f2c9d8bf8a6308a4662be4366e5d560f9b385778681991ac132b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"809b92840fd4a155a08a126e4f70ed8476d0e1a553afbfd8e2c76943932208e9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T16:22:29Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T16:22:29Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/73ccfaaa5699f2c9d8bf8a6308a4662be4366e5d560f9b385778681991ac132b"}
{"level":"info","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"809b92840fd4a155a08a126e4f70ed8476d0e1a553afbfd8e2c76943932208e9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"73ccfaaa5699f2c9d8bf8a6308a4662be4366e5d560f9b385778681991ac132b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T16:22:29Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T16:22:29Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["73ccfaaa5699f2c9d8bf8a6308a4662be4366e5d560f9b385778681991ac132b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"73ccfaaa5699f2c9d8bf8a6308a4662be4366e5d560f9b385778681991ac132b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2cd9f70573fe430a64feafe741ec59c99bfb245a3ff474846a832a2d5eaa4693","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T16:22:29Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T16:22:29Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/809b92840fd4a155a08a126e4f70ed8476d0e1a553afbfd8e2c76943932208e9"}
{"level":"info","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2cd9f70573fe430a64feafe741ec59c99bfb245a3ff474846a832a2d5eaa4693","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"809b92840fd4a155a08a126e4f70ed8476d0e1a553afbfd8e2c76943932208e9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T16:22:29Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T16:22:29Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["809b92840fd4a155a08a126e4f70ed8476d0e1a553afbfd8e2c76943932208e9"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2cd9f70573fe430a64feafe741ec59c99bfb245a3ff474846a832a2d5eaa4693"}
{"level":"info","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"809b92840fd4a155a08a126e4f70ed8476d0e1a553afbfd8e2c76943932208e9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"73ccfaaa5699f2c9d8bf8a6308a4662be4366e5d560f9b385778681991ac132b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T16:22:29Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T16:22:29Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"73ccfaaa5699f2c9d8bf8a6308a4662be4366e5d560f9b385778681991ac132b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2cd9f70573fe430a64feafe741ec59c99bfb245a3ff474846a832a2d5eaa4693","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T16:22:29Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T16:22:29Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["2cd9f70573fe430a64feafe741ec59c99bfb245a3ff474846a832a2d5eaa4693"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/73ccfaaa5699f2c9d8bf8a6308a4662be4366e5d560f9b385778681991ac132b"}
{"level":"info","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2cd9f70573fe430a64feafe741ec59c99bfb245a3ff474846a832a2d5eaa4693","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"809b92840fd4a155a08a126e4f70ed8476d0e1a553afbfd8e2c76943932208e9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T16:22:29Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T16:22:29Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"809b92840fd4a155a08a126e4f70ed8476d0e1a553afbfd8e2c76943932208e9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"73ccfaaa5699f2c9d8bf8a6308a4662be4366e5d560f9b385778681991ac132b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T16:22:29Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T16:22:29Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["73ccfaaa5699f2c9d8bf8a6308a4662be4366e5d560f9b385778681991ac132b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"73ccfaaa5699f2c9d8bf8a6308a4662be4366e5d560f9b385778681991ac132b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9265ec26d1ef15adac5250f6ab6bcf9acc0c63e8855b40e1ef1b83f3f434e678","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T16:22:29Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T16:22:29Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/809b92840fd4a155a08a126e4f70ed8476d0e1a553afbfd8e2c76943932208e9"}
{"level":"info","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9265ec26d1ef15adac5250f6ab6bcf9acc0c63e8855b40e1ef1b83f3f434e678","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2cd9f70573fe430a64feafe741ec59c99bfb245a3ff474846a832a2d5eaa4693","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T16:22:29Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T16:22:29Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2cd9f70573fe430a64feafe741ec59c99bfb245a3ff474846a832a2d5eaa4693","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"61f60c9572f60aa2451333d6ab64aaff510577ec12caa022180f44f41713ff38","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T16:22:29Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T16:22:29Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2cd9f70573fe430a64feafe741ec59c99bfb245a3ff474846a832a2d5eaa4693"}
{"level":"info","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"61f60c9572f60aa2451333d6ab64aaff510577ec12caa022180f44f41713ff38","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"809b92840fd4a155a08a126e4f70ed8476d0e1a553afbfd8e2c76943932208e9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T16:22:29Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T16:22:29Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["809b92840fd4a155a08a126e4f70ed8476d0e1a553afbfd8e2c76943932208e9"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"809b92840fd4a155a08a126e4f70ed8476d0e1a553afbfd8e2c76943932208e9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"73ccfaaa5699f2c9d8bf8a6308a4662be4366e5d560f9b385778681991ac132b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9265ec26d1ef15adac5250f6ab6bcf9acc0c63e8855b40e1ef1b83f3f434e678","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T16:22:29Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T16:22:29Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9265ec26d1ef15adac5250f6ab6bcf9acc0c63e8855b40e1ef1b83f3f434e678"}
{"level":"info","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9265ec26d1ef15adac5250f6ab6bcf9acc0c63e8855b40e1ef1b83f3f434e678","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2cd9f70573fe430a64feafe741ec59c99bfb245a3ff474846a832a2d5eaa4693","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T16:22:29Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T16:22:29Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["2cd9f70573fe430a64feafe741ec59c99bfb245a3ff474846a832a2d5eaa4693"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/73ccfaaa5699f2c9d8bf8a6308a4662be4366e5d560f9b385778681991ac132b"}
{"level":"info","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2cd9f70573fe430a64feafe741ec59c99bfb245a3ff474846a832a2d5eaa4693","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"61f60c9572f60aa2451333d6ab64aaff510577ec12caa022180f44f41713ff38","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T16:22:29Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T16:22:29Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"61f60c9572f60aa2451333d6ab64aaff510577ec12caa022180f44f41713ff38","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"809b92840fd4a155a08a126e4f70ed8476d0e1a553afbfd8e2c76943932208e9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9265ec26d1ef15adac5250f6ab6bcf9acc0c63e8855b40e1ef1b83f3f434e678","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T16:22:29Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T16:22:29Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9265ec26d1ef15adac5250f6ab6bcf9acc0c63e8855b40e1ef1b83f3f434e678"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/61f60c9572f60aa2451333d6ab64aaff510577ec12caa022180f44f41713ff38"}
{"level":"info","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9265ec26d1ef15adac5250f6ab6bcf9acc0c63e8855b40e1ef1b83f3f434e678","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2cd9f70573fe430a64feafe741ec59c99bfb245a3ff474846a832a2d5eaa4693","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"61f60c9572f60aa2451333d6ab64aaff510577ec12caa022180f44f41713ff38","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T16:22:29Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T16:22:29Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["61f60c9572f60aa2451333d6ab64aaff510577ec12caa022180f44f41713ff38"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"61f60c9572f60aa2451333d6ab64aaff510577ec12caa022180f44f41713ff38","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9265ec26d1ef15adac5250f6ab6bcf9acc0c63e8855b40e1ef1b83f3f434e678","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"61f60c9572f60aa2451333d6ab64aaff510577ec12caa022180f44f41713ff38","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/809b92840fd4a155a08a126e4f70ed8476d0e1a553afbfd8e2c76943932208e9"}
{"level":"info","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2cd9f70573fe430a64feafe741ec59c99bfb245a3ff474846a832a2d5eaa4693"}
{"level":"info","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9265ec26d1ef15adac5250f6ab6bcf9acc0c63e8855b40e1ef1b83f3f434e678"}
{"level":"info","ts":"2026-07-24T16:22:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/61f60c9572f60aa2451333d6ab64aaff510577ec12caa022180f44f41713ff38"}
{"level":"info","ts":"2026-07-24T16:22:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"70c8a2ca-55aa-4e06-b4f7-19366ccbca21","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:45440","PortSpecifier":{"PortValue":45440}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"70c8a2ca-55aa-4e06-b4f7-19366ccbca21","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-ipp-a-5d0582.apps.fcfd467d-eea8-41c6-9191-af8557b854d0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T16:22:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"70c8a2ca-55aa-4e06-b4f7-19366ccbca21","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:45440","PortSpecifier":{"PortValue":45440}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784910155,"nanos":449398373},"http":{"id":"70c8a2ca-55aa-4e06-b4f7-19366ccbca21","method":"POST","headers":{":authority":"e2e-ipp-a-5d0582.apps.fcfd467d-eea8-41c6-9191-af8557b854d0.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T16:22:35Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"70c8a2ca-55aa-4e06-b4f7-19366ccbca21","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-24T16:22:35Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"70c8a2ca-55aa-4e06-b4f7-19366ccbca21","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"cfa92684-529a-4738-904f-2f855e0bf7d0","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=674fb2f7-2bd8-4cd9-8782-38d631eb1bc5"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/af8557b854d0"]}}
{"level":"debug","ts":"2026-07-24T16:22:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"70c8a2ca-55aa-4e06-b4f7-19366ccbca21","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/af8557b854d0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=674fb2f7-2bd8-4cd9-8782-38d631eb1bc5"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"cfa92684-529a-4738-904f-2f855e0bf7d0","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"809b92840fd4a155a08a126e4f70ed8476d0e1a553afbfd8e2c76943932208e9"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.54:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-ipp-a-5d0582.apps.fcfd467d-eea8-41c6-9191-af8557b854d0.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T16:22:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"70c8a2ca-55aa-4e06-b4f7-19366ccbca21","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:22:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"70c8a2ca-55aa-4e06-b4f7-19366ccbca21","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:22:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"70c8a2ca-55aa-4e06-b4f7-19366ccbca21","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-ipp-a-5d0582/ipp-route-5d0582\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-ipp-a-5d0582/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:22:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"70c8a2ca-55aa-4e06-b4f7-19366ccbca21","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-24T16:22:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"70c8a2ca-55aa-4e06-b4f7-19366ccbca21","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T16:22:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"70c8a2ca-55aa-4e06-b4f7-19366ccbca21","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-24T16:22:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"70c8a2ca-55aa-4e06-b4f7-19366ccbca21","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T16:22:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"70c8a2ca-55aa-4e06-b4f7-19366ccbca21","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T16:22:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f6aab692-6aa3-4b35-9513-e1b3b3631688","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:45454","PortSpecifier":{"PortValue":45454}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f6aab692-6aa3-4b35-9513-e1b3b3631688","method":"POST","path":"/ai-tenant-e2e-ipp-a-5d0582/ipp-route-5d0582/v1/chat/completions","host":"e2e-ipp-a-5d0582.apps.fcfd467d-eea8-41c6-9191-af8557b854d0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T16:22:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f6aab692-6aa3-4b35-9513-e1b3b3631688","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:45454","PortSpecifier":{"PortValue":45454}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784910157,"nanos":511047795},"http":{"id":"f6aab692-6aa3-4b35-9513-e1b3b3631688","method":"POST","headers":{":authority":"e2e-ipp-a-5d0582.apps.fcfd467d-eea8-41c6-9191-af8557b854d0.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-ipp-a-5d0582/ipp-route-5d0582/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T16:22:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f6aab692-6aa3-4b35-9513-e1b3b3631688","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-14fcj6kZhVkQRXLQL_FM0yDKpHF24bH5SAb7t7tp8Io8G2qeeSsTyvDbYJX4g"}
{"level":"debug","ts":"2026-07-24T16:22:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f6aab692-6aa3-4b35-9513-e1b3b3631688","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-ipp-a-5d0582.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-14fcj6kZhVkQRXLQL_FM0yDKpHF24bH5SAb7t7tp8Io8G2qeeSsTyvDbYJX4g\"}"}
{"level":"debug","ts":"2026-07-24T16:22:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f6aab692-6aa3-4b35-9513-e1b3b3631688","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-ipp-a-5d0582.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"2edd8c26-0035-4652-8efc-24a6e4b06439","keyName":"e2e-ipp-5d0582","subscription":"ipp-route-5d0582-sub","tenant":"e2e-ipp-a-5d0582","userId":"2edd8c26-0035-4652-8efc-24a6e4b06439","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T16:22:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f6aab692-6aa3-4b35-9513-e1b3b3631688","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-ipp-a-5d0582.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-ipp-a-5d0582/ipp-route-5d0582\",\"requestedSubscription\":\"ipp-route-5d0582-sub\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T16:22:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f6aab692-6aa3-4b35-9513-e1b3b3631688","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-ipp-a-5d0582.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"ipp-route-5d0582","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"ipp-route-5d0582-sub","namespace":"ai-tenant-e2e-ipp-a-5d0582","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-ipp-a-5d0582/ipp-route-5d0582"}}
{"level":"debug","ts":"2026-07-24T16:22:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f6aab692-6aa3-4b35-9513-e1b3b3631688","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T16:22:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f6aab692-6aa3-4b35-9513-e1b3b3631688","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:22:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f6aab692-6aa3-4b35-9513-e1b3b3631688","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:22:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f6aab692-6aa3-4b35-9513-e1b3b3631688","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:22:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f6aab692-6aa3-4b35-9513-e1b3b3631688","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-ipp-a-5d0582/ipp-route-5d0582\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-ipp-a-5d0582/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:22:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f6aab692-6aa3-4b35-9513-e1b3b3631688","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T16:22:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f6aab692-6aa3-4b35-9513-e1b3b3631688","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"ipp-route-5d0582-sub"}
{"level":"debug","ts":"2026-07-24T16:22:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f6aab692-6aa3-4b35-9513-e1b3b3631688","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T16:22:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f6aab692-6aa3-4b35-9513-e1b3b3631688","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"2edd8c26-0035-4652-8efc-24a6e4b06439","keyName":"e2e-ipp-5d0582","selected_subscription":"ipp-route-5d0582-sub","selected_subscription_key":"ai-tenant-e2e-ipp-a-5d0582/ipp-route-5d0582-sub@ai-tenant-e2e-ipp-a-5d0582/ipp-route-5d0582","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"ipp-route-5d0582","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"ipp-route-5d0582-sub","namespace":"ai-tenant-e2e-ipp-a-5d0582","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-ipp-a-5d0582/ipp-route-5d0582"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T16:22:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f6aab692-6aa3-4b35-9513-e1b3b3631688","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T16:22:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f6aab692-6aa3-4b35-9513-e1b3b3631688","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T16:23:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/54b64547a9e31d48828647b30a79bf622bee2641e0a135172d2561049e93595a"}
{"level":"info","ts":"2026-07-24T16:23:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9265ec26d1ef15adac5250f6ab6bcf9acc0c63e8855b40e1ef1b83f3f434e678"}
{"level":"info","ts":"2026-07-24T16:23:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2cd9f70573fe430a64feafe741ec59c99bfb245a3ff474846a832a2d5eaa4693"}
{"level":"info","ts":"2026-07-24T16:23:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d0ee3e072bdbbb2cd60869d621dbd0730024094c2595f2245c00de04faf2ed86"}
{"level":"info","ts":"2026-07-24T16:23:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/8ae59eb60456e45339cc055e658765d174ea8160aabcaeb88e6e5b08c9652f2c"}
{"level":"info","ts":"2026-07-24T16:23:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2fc6c3a226fd177d9996a1c7ef93c41306a5938dc8efd68cddd6eda9eeae6235"}
{"level":"info","ts":"2026-07-24T16:23:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/61f60c9572f60aa2451333d6ab64aaff510577ec12caa022180f44f41713ff38"}
{"level":"info","ts":"2026-07-24T16:23:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/809b92840fd4a155a08a126e4f70ed8476d0e1a553afbfd8e2c76943932208e9"}
{"level":"info","ts":"2026-07-24T16:23:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/73ccfaaa5699f2c9d8bf8a6308a4662be4366e5d560f9b385778681991ac132b"}
{"level":"info","ts":"2026-07-24T16:23:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ff213b8c7217bdb6037debc15f8716fc7508a12d1c68a5c178ea3706088196d0"}
{"level":"info","ts":"2026-07-24T16:23:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/5b75436bca2409b4bfa07525415b986aeb7e26b33e5b30a7012fb6fcd348f405"}
{"level":"info","ts":"2026-07-24T16:23:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/acf40084ba9f293aef0670e847b9cb56e73d25f620415698b310c6e0d1e89e09"}