{"level":"info","ts":"2026-07-22T15:59:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/044dbbfc6a750b7895d85d101c22119670dc45a4d1ec66f772cccffa22914c29"}
{"level":"debug","ts":"2026-07-22T15:59:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"044dbbfc6a750b7895d85d101c22119670dc45a4d1ec66f772cccffa22914c29","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T15:59:26Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T15:59:26Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["044dbbfc6a750b7895d85d101c22119670dc45a4d1ec66f772cccffa22914c29"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T15:59:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"044dbbfc6a750b7895d85d101c22119670dc45a4d1ec66f772cccffa22914c29","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T15:59:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"044dbbfc6a750b7895d85d101c22119670dc45a4d1ec66f772cccffa22914c29","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T15:59:26Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T15:59:26Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T15:59:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"044dbbfc6a750b7895d85d101c22119670dc45a4d1ec66f772cccffa22914c29","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T15:59:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"044dbbfc6a750b7895d85d101c22119670dc45a4d1ec66f772cccffa22914c29","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T15:59:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"10fbcf06e3e5fc96692f1a2503de5b90558867d274fdd5573a47e798f30ab447","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T15:59:26Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T15:59:26Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T15:59:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/044dbbfc6a750b7895d85d101c22119670dc45a4d1ec66f772cccffa22914c29"}
{"level":"info","ts":"2026-07-22T15:59:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"10fbcf06e3e5fc96692f1a2503de5b90558867d274fdd5573a47e798f30ab447","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T15:59:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"044dbbfc6a750b7895d85d101c22119670dc45a4d1ec66f772cccffa22914c29","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T15:59:26Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T15:59:26Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["044dbbfc6a750b7895d85d101c22119670dc45a4d1ec66f772cccffa22914c29"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T15:59:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/10fbcf06e3e5fc96692f1a2503de5b90558867d274fdd5573a47e798f30ab447"}
{"level":"info","ts":"2026-07-22T15:59:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"044dbbfc6a750b7895d85d101c22119670dc45a4d1ec66f772cccffa22914c29","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T15:59:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"10fbcf06e3e5fc96692f1a2503de5b90558867d274fdd5573a47e798f30ab447","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T15:59:26Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T15:59:26Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["10fbcf06e3e5fc96692f1a2503de5b90558867d274fdd5573a47e798f30ab447"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T15:59:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/044dbbfc6a750b7895d85d101c22119670dc45a4d1ec66f772cccffa22914c29"}
{"level":"info","ts":"2026-07-22T15:59:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"10fbcf06e3e5fc96692f1a2503de5b90558867d274fdd5573a47e798f30ab447","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T15:59:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"044dbbfc6a750b7895d85d101c22119670dc45a4d1ec66f772cccffa22914c29","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T15:59:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"10fbcf06e3e5fc96692f1a2503de5b90558867d274fdd5573a47e798f30ab447","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T15:59:26Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T15:59:26Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T15:59:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/10fbcf06e3e5fc96692f1a2503de5b90558867d274fdd5573a47e798f30ab447"}
{"level":"info","ts":"2026-07-22T15:59:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"10fbcf06e3e5fc96692f1a2503de5b90558867d274fdd5573a47e798f30ab447","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T15:59:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"10fbcf06e3e5fc96692f1a2503de5b90558867d274fdd5573a47e798f30ab447","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T15:59:26Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T15:59:26Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["10fbcf06e3e5fc96692f1a2503de5b90558867d274fdd5573a47e798f30ab447"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T15:59:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/044dbbfc6a750b7895d85d101c22119670dc45a4d1ec66f772cccffa22914c29"}
{"level":"info","ts":"2026-07-22T15:59:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"10fbcf06e3e5fc96692f1a2503de5b90558867d274fdd5573a47e798f30ab447","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T15:59:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"10fbcf06e3e5fc96692f1a2503de5b90558867d274fdd5573a47e798f30ab447","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T15:59:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"10fbcf06e3e5fc96692f1a2503de5b90558867d274fdd5573a47e798f30ab447","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T15:59:26Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T15:59:26Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T15:59:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"10fbcf06e3e5fc96692f1a2503de5b90558867d274fdd5573a47e798f30ab447","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T15:59:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"10fbcf06e3e5fc96692f1a2503de5b90558867d274fdd5573a47e798f30ab447","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T15:59:26Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T15:59:26Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T15:59:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/10fbcf06e3e5fc96692f1a2503de5b90558867d274fdd5573a47e798f30ab447"}
{"level":"error","ts":"2026-07-22T15:59:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"10fbcf06e3e5fc96692f1a2503de5b90558867d274fdd5573a47e798f30ab447","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"10fbcf06e3e5fc96692f1a2503de5b90558867d274fdd5573a47e798f30ab447\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-22T15:59:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"559864ad3941b79ccd52fb2dadd5b2fdd0f4290bec91470ec91c5a715996cddb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T15:59:26Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T15:59:26Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T15:59:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"559864ad3941b79ccd52fb2dadd5b2fdd0f4290bec91470ec91c5a715996cddb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T15:59:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"10fbcf06e3e5fc96692f1a2503de5b90558867d274fdd5573a47e798f30ab447","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T15:59:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"559864ad3941b79ccd52fb2dadd5b2fdd0f4290bec91470ec91c5a715996cddb","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-22T15:59:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/10fbcf06e3e5fc96692f1a2503de5b90558867d274fdd5573a47e798f30ab447"}
{"level":"debug","ts":"2026-07-22T15:59:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"559864ad3941b79ccd52fb2dadd5b2fdd0f4290bec91470ec91c5a715996cddb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T15:59:26Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T15:59:26Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T15:59:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"559864ad3941b79ccd52fb2dadd5b2fdd0f4290bec91470ec91c5a715996cddb","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-22T15:59:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/559864ad3941b79ccd52fb2dadd5b2fdd0f4290bec91470ec91c5a715996cddb"}
{"level":"debug","ts":"2026-07-22T15:59:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"559864ad3941b79ccd52fb2dadd5b2fdd0f4290bec91470ec91c5a715996cddb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T15:59:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"10fbcf06e3e5fc96692f1a2503de5b90558867d274fdd5573a47e798f30ab447","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T15:59:26Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T15:59:26Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["10fbcf06e3e5fc96692f1a2503de5b90558867d274fdd5573a47e798f30ab447"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T15:59:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/559864ad3941b79ccd52fb2dadd5b2fdd0f4290bec91470ec91c5a715996cddb"}
{"level":"info","ts":"2026-07-22T15:59:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"10fbcf06e3e5fc96692f1a2503de5b90558867d274fdd5573a47e798f30ab447","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T15:59:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"559864ad3941b79ccd52fb2dadd5b2fdd0f4290bec91470ec91c5a715996cddb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T15:59:26Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T15:59:26Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["559864ad3941b79ccd52fb2dadd5b2fdd0f4290bec91470ec91c5a715996cddb"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T15:59:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"559864ad3941b79ccd52fb2dadd5b2fdd0f4290bec91470ec91c5a715996cddb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T15:59:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"10fbcf06e3e5fc96692f1a2503de5b90558867d274fdd5573a47e798f30ab447","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T15:59:26Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T15:59:26Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T15:59:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/10fbcf06e3e5fc96692f1a2503de5b90558867d274fdd5573a47e798f30ab447"}
{"level":"info","ts":"2026-07-22T15:59:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"10fbcf06e3e5fc96692f1a2503de5b90558867d274fdd5573a47e798f30ab447","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T15:59:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"559864ad3941b79ccd52fb2dadd5b2fdd0f4290bec91470ec91c5a715996cddb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T15:59:26Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T15:59:26Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/559864ad3941b79ccd52fb2dadd5b2fdd0f4290bec91470ec91c5a715996cddb"}
{"level":"info","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"559864ad3941b79ccd52fb2dadd5b2fdd0f4290bec91470ec91c5a715996cddb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3b29e83740468d7476d23855c4a2c18a8ac90c3582a4c99c0b4c5ef3dfcaa1c9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T15:59:27Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T15:59:27Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3b29e83740468d7476d23855c4a2c18a8ac90c3582a4c99c0b4c5ef3dfcaa1c9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"10fbcf06e3e5fc96692f1a2503de5b90558867d274fdd5573a47e798f30ab447","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T15:59:27Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T15:59:27Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["10fbcf06e3e5fc96692f1a2503de5b90558867d274fdd5573a47e798f30ab447"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3b29e83740468d7476d23855c4a2c18a8ac90c3582a4c99c0b4c5ef3dfcaa1c9"}
{"level":"info","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"10fbcf06e3e5fc96692f1a2503de5b90558867d274fdd5573a47e798f30ab447","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"559864ad3941b79ccd52fb2dadd5b2fdd0f4290bec91470ec91c5a715996cddb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T15:59:27Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T15:59:27Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["559864ad3941b79ccd52fb2dadd5b2fdd0f4290bec91470ec91c5a715996cddb"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"559864ad3941b79ccd52fb2dadd5b2fdd0f4290bec91470ec91c5a715996cddb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3b29e83740468d7476d23855c4a2c18a8ac90c3582a4c99c0b4c5ef3dfcaa1c9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T15:59:27Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T15:59:27Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3b29e83740468d7476d23855c4a2c18a8ac90c3582a4c99c0b4c5ef3dfcaa1c9"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/10fbcf06e3e5fc96692f1a2503de5b90558867d274fdd5573a47e798f30ab447"}
{"level":"info","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3b29e83740468d7476d23855c4a2c18a8ac90c3582a4c99c0b4c5ef3dfcaa1c9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"10fbcf06e3e5fc96692f1a2503de5b90558867d274fdd5573a47e798f30ab447","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"559864ad3941b79ccd52fb2dadd5b2fdd0f4290bec91470ec91c5a715996cddb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T15:59:27Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T15:59:27Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"559864ad3941b79ccd52fb2dadd5b2fdd0f4290bec91470ec91c5a715996cddb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3b29e83740468d7476d23855c4a2c18a8ac90c3582a4c99c0b4c5ef3dfcaa1c9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"559864ad3941b79ccd52fb2dadd5b2fdd0f4290bec91470ec91c5a715996cddb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"559864ad3941b79ccd52fb2dadd5b2fdd0f4290bec91470ec91c5a715996cddb","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/559864ad3941b79ccd52fb2dadd5b2fdd0f4290bec91470ec91c5a715996cddb"}
{"level":"debug","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"559864ad3941b79ccd52fb2dadd5b2fdd0f4290bec91470ec91c5a715996cddb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T15:59:27Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T15:59:27Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["559864ad3941b79ccd52fb2dadd5b2fdd0f4290bec91470ec91c5a715996cddb"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3b29e83740468d7476d23855c4a2c18a8ac90c3582a4c99c0b4c5ef3dfcaa1c9"}
{"level":"info","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"559864ad3941b79ccd52fb2dadd5b2fdd0f4290bec91470ec91c5a715996cddb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"559864ad3941b79ccd52fb2dadd5b2fdd0f4290bec91470ec91c5a715996cddb","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/10fbcf06e3e5fc96692f1a2503de5b90558867d274fdd5573a47e798f30ab447"}
{"level":"debug","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b1c2c74e444dc331d815131025fc40288fa1c0a4f3b09337f84938306abeb057","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T15:59:27Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T15:59:27Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/559864ad3941b79ccd52fb2dadd5b2fdd0f4290bec91470ec91c5a715996cddb"}
{"level":"info","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b1c2c74e444dc331d815131025fc40288fa1c0a4f3b09337f84938306abeb057","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4bc156861a86161f0d9709c648f2d52dfba253577077af47aea91d9b7c8d547b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T15:59:27Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T15:59:27Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b1c2c74e444dc331d815131025fc40288fa1c0a4f3b09337f84938306abeb057"}
{"level":"info","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4bc156861a86161f0d9709c648f2d52dfba253577077af47aea91d9b7c8d547b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b1c2c74e444dc331d815131025fc40288fa1c0a4f3b09337f84938306abeb057","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T15:59:27Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T15:59:27Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b1c2c74e444dc331d815131025fc40288fa1c0a4f3b09337f84938306abeb057"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4bc156861a86161f0d9709c648f2d52dfba253577077af47aea91d9b7c8d547b"}
{"level":"info","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b1c2c74e444dc331d815131025fc40288fa1c0a4f3b09337f84938306abeb057","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4bc156861a86161f0d9709c648f2d52dfba253577077af47aea91d9b7c8d547b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T15:59:27Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T15:59:27Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4bc156861a86161f0d9709c648f2d52dfba253577077af47aea91d9b7c8d547b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b1c2c74e444dc331d815131025fc40288fa1c0a4f3b09337f84938306abeb057"}
{"level":"info","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4bc156861a86161f0d9709c648f2d52dfba253577077af47aea91d9b7c8d547b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b1c2c74e444dc331d815131025fc40288fa1c0a4f3b09337f84938306abeb057","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4bc156861a86161f0d9709c648f2d52dfba253577077af47aea91d9b7c8d547b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T15:59:27Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T15:59:27Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4bc156861a86161f0d9709c648f2d52dfba253577077af47aea91d9b7c8d547b"}
{"level":"info","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4bc156861a86161f0d9709c648f2d52dfba253577077af47aea91d9b7c8d547b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4bc156861a86161f0d9709c648f2d52dfba253577077af47aea91d9b7c8d547b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T15:59:27Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T15:59:27Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4bc156861a86161f0d9709c648f2d52dfba253577077af47aea91d9b7c8d547b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b1c2c74e444dc331d815131025fc40288fa1c0a4f3b09337f84938306abeb057"}
{"level":"info","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4bc156861a86161f0d9709c648f2d52dfba253577077af47aea91d9b7c8d547b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ed95769c2bca54eb95d56ead8f12a2a65f5d96e659aff008cc4226e028b9af75","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T15:59:27Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T15:59:27Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ed95769c2bca54eb95d56ead8f12a2a65f5d96e659aff008cc4226e028b9af75","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4bc156861a86161f0d9709c648f2d52dfba253577077af47aea91d9b7c8d547b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T15:59:27Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T15:59:27Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4bc156861a86161f0d9709c648f2d52dfba253577077af47aea91d9b7c8d547b"}
{"level":"info","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4bc156861a86161f0d9709c648f2d52dfba253577077af47aea91d9b7c8d547b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ed95769c2bca54eb95d56ead8f12a2a65f5d96e659aff008cc4226e028b9af75","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T15:59:27Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T15:59:27Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ed95769c2bca54eb95d56ead8f12a2a65f5d96e659aff008cc4226e028b9af75"}
{"level":"info","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ed95769c2bca54eb95d56ead8f12a2a65f5d96e659aff008cc4226e028b9af75","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4bc156861a86161f0d9709c648f2d52dfba253577077af47aea91d9b7c8d547b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ed95769c2bca54eb95d56ead8f12a2a65f5d96e659aff008cc4226e028b9af75","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T15:59:27Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T15:59:27Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ed95769c2bca54eb95d56ead8f12a2a65f5d96e659aff008cc4226e028b9af75"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4bc156861a86161f0d9709c648f2d52dfba253577077af47aea91d9b7c8d547b"}
{"level":"info","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ed95769c2bca54eb95d56ead8f12a2a65f5d96e659aff008cc4226e028b9af75","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4bc156861a86161f0d9709c648f2d52dfba253577077af47aea91d9b7c8d547b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T15:59:27Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T15:59:27Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4bc156861a86161f0d9709c648f2d52dfba253577077af47aea91d9b7c8d547b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ed95769c2bca54eb95d56ead8f12a2a65f5d96e659aff008cc4226e028b9af75"}
{"level":"info","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4bc156861a86161f0d9709c648f2d52dfba253577077af47aea91d9b7c8d547b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ed95769c2bca54eb95d56ead8f12a2a65f5d96e659aff008cc4226e028b9af75","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T15:59:27Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T15:59:27Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ed95769c2bca54eb95d56ead8f12a2a65f5d96e659aff008cc4226e028b9af75"}
{"level":"info","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ed95769c2bca54eb95d56ead8f12a2a65f5d96e659aff008cc4226e028b9af75","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4bc156861a86161f0d9709c648f2d52dfba253577077af47aea91d9b7c8d547b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T15:59:27Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T15:59:27Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4bc156861a86161f0d9709c648f2d52dfba253577077af47aea91d9b7c8d547b"}
{"level":"info","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4bc156861a86161f0d9709c648f2d52dfba253577077af47aea91d9b7c8d547b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ed95769c2bca54eb95d56ead8f12a2a65f5d96e659aff008cc4226e028b9af75","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4bc156861a86161f0d9709c648f2d52dfba253577077af47aea91d9b7c8d547b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T15:59:27Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T15:59:27Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4bc156861a86161f0d9709c648f2d52dfba253577077af47aea91d9b7c8d547b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4bc156861a86161f0d9709c648f2d52dfba253577077af47aea91d9b7c8d547b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ed95769c2bca54eb95d56ead8f12a2a65f5d96e659aff008cc4226e028b9af75","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4bc156861a86161f0d9709c648f2d52dfba253577077af47aea91d9b7c8d547b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T15:59:27Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T15:59:27Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4bc156861a86161f0d9709c648f2d52dfba253577077af47aea91d9b7c8d547b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ed95769c2bca54eb95d56ead8f12a2a65f5d96e659aff008cc4226e028b9af75"}
{"level":"error","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"4bc156861a86161f0d9709c648f2d52dfba253577077af47aea91d9b7c8d547b","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"4bc156861a86161f0d9709c648f2d52dfba253577077af47aea91d9b7c8d547b\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4bc156861a86161f0d9709c648f2d52dfba253577077af47aea91d9b7c8d547b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T15:59:27Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T15:59:27Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4bc156861a86161f0d9709c648f2d52dfba253577077af47aea91d9b7c8d547b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ed95769c2bca54eb95d56ead8f12a2a65f5d96e659aff008cc4226e028b9af75","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T15:59:27Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T15:59:27Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ed95769c2bca54eb95d56ead8f12a2a65f5d96e659aff008cc4226e028b9af75"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4bc156861a86161f0d9709c648f2d52dfba253577077af47aea91d9b7c8d547b"}
{"level":"info","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ed95769c2bca54eb95d56ead8f12a2a65f5d96e659aff008cc4226e028b9af75","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4bc156861a86161f0d9709c648f2d52dfba253577077af47aea91d9b7c8d547b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T15:59:27Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T15:59:27Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4bc156861a86161f0d9709c648f2d52dfba253577077af47aea91d9b7c8d547b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bed2e654ee47a83fa34b2ea40e6902af2d1badc015ea53fa26e1dfd01bc385d3"}
{"level":"info","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4bc156861a86161f0d9709c648f2d52dfba253577077af47aea91d9b7c8d547b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"bed2e654ee47a83fa34b2ea40e6902af2d1badc015ea53fa26e1dfd01bc385d3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T15:59:27Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T15:59:27Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["bed2e654ee47a83fa34b2ea40e6902af2d1badc015ea53fa26e1dfd01bc385d3"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4bc156861a86161f0d9709c648f2d52dfba253577077af47aea91d9b7c8d547b"}
{"level":"info","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ed95769c2bca54eb95d56ead8f12a2a65f5d96e659aff008cc4226e028b9af75"}
{"level":"info","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"bed2e654ee47a83fa34b2ea40e6902af2d1badc015ea53fa26e1dfd01bc385d3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ed95769c2bca54eb95d56ead8f12a2a65f5d96e659aff008cc4226e028b9af75","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4bc156861a86161f0d9709c648f2d52dfba253577077af47aea91d9b7c8d547b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T15:59:27Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T15:59:27Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4bc156861a86161f0d9709c648f2d52dfba253577077af47aea91d9b7c8d547b"}
{"level":"info","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bed2e654ee47a83fa34b2ea40e6902af2d1badc015ea53fa26e1dfd01bc385d3"}
{"level":"info","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dcfa377d07ee6bf7e9a665a7edbc233097e6aa5944d0a3983e586df2089d63fe"}
{"level":"info","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4bc156861a86161f0d9709c648f2d52dfba253577077af47aea91d9b7c8d547b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"bed2e654ee47a83fa34b2ea40e6902af2d1badc015ea53fa26e1dfd01bc385d3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dcfa377d07ee6bf7e9a665a7edbc233097e6aa5944d0a3983e586df2089d63fe","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T15:59:27Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T15:59:27Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["dcfa377d07ee6bf7e9a665a7edbc233097e6aa5944d0a3983e586df2089d63fe"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4bc156861a86161f0d9709c648f2d52dfba253577077af47aea91d9b7c8d547b"}
{"level":"info","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dcfa377d07ee6bf7e9a665a7edbc233097e6aa5944d0a3983e586df2089d63fe","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4bc156861a86161f0d9709c648f2d52dfba253577077af47aea91d9b7c8d547b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T15:59:27Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T15:59:27Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4bc156861a86161f0d9709c648f2d52dfba253577077af47aea91d9b7c8d547b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dcfa377d07ee6bf7e9a665a7edbc233097e6aa5944d0a3983e586df2089d63fe"}
{"level":"info","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4bc156861a86161f0d9709c648f2d52dfba253577077af47aea91d9b7c8d547b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dcfa377d07ee6bf7e9a665a7edbc233097e6aa5944d0a3983e586df2089d63fe","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e03fdd5a143a240868123824a24fb7bba9fd12ff84695e5b17caf838dce55d36","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T15:59:27Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T15:59:27Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e03fdd5a143a240868123824a24fb7bba9fd12ff84695e5b17caf838dce55d36"}
{"level":"info","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3bfcb9078bfab1746d665389fb137bc0788f34a8d0047daab300174662ebf48b"}
{"level":"info","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4bc156861a86161f0d9709c648f2d52dfba253577077af47aea91d9b7c8d547b"}
{"level":"info","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e03fdd5a143a240868123824a24fb7bba9fd12ff84695e5b17caf838dce55d36","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3bfcb9078bfab1746d665389fb137bc0788f34a8d0047daab300174662ebf48b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T15:59:27Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T15:59:27Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3bfcb9078bfab1746d665389fb137bc0788f34a8d0047daab300174662ebf48b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9895548f95df31cd9bab5baf2b2429fae34fc49b852532778cba13ac39b589e3"}
{"level":"info","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e03fdd5a143a240868123824a24fb7bba9fd12ff84695e5b17caf838dce55d36"}
{"level":"info","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c2afa9b7e022783f4f938c2c5faae09335fe51fc4b88aabddd96e2cf4153be8e"}
{"level":"info","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3bfcb9078bfab1746d665389fb137bc0788f34a8d0047daab300174662ebf48b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4bc156861a86161f0d9709c648f2d52dfba253577077af47aea91d9b7c8d547b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9895548f95df31cd9bab5baf2b2429fae34fc49b852532778cba13ac39b589e3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T15:59:27Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T15:59:27Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9895548f95df31cd9bab5baf2b2429fae34fc49b852532778cba13ac39b589e3"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ec1cd086346e07db13894efba57b4a3c91e5e1b6f7625cdb0c5a31b0fcca364f"}
{"level":"info","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3bfcb9078bfab1746d665389fb137bc0788f34a8d0047daab300174662ebf48b"}
{"level":"info","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9895548f95df31cd9bab5baf2b2429fae34fc49b852532778cba13ac39b589e3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e03fdd5a143a240868123824a24fb7bba9fd12ff84695e5b17caf838dce55d36","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T15:59:27Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T15:59:27Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e03fdd5a143a240868123824a24fb7bba9fd12ff84695e5b17caf838dce55d36"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/17de2adb6d944260e5a672a3d74f0089a50aa165ffcd2955e7e4735b79812085"}
{"level":"info","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9895548f95df31cd9bab5baf2b2429fae34fc49b852532778cba13ac39b589e3"}
{"level":"info","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e03fdd5a143a240868123824a24fb7bba9fd12ff84695e5b17caf838dce55d36","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c2afa9b7e022783f4f938c2c5faae09335fe51fc4b88aabddd96e2cf4153be8e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T15:59:27Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T15:59:27Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c2afa9b7e022783f4f938c2c5faae09335fe51fc4b88aabddd96e2cf4153be8e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d41faccd59d1ecdf40a6bebd7377bb6a6fe285547f635ed8f2c9a7dfb0c02536"}
{"level":"info","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c2afa9b7e022783f4f938c2c5faae09335fe51fc4b88aabddd96e2cf4153be8e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ec1cd086346e07db13894efba57b4a3c91e5e1b6f7625cdb0c5a31b0fcca364f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T15:59:27Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T15:59:27Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ec1cd086346e07db13894efba57b4a3c91e5e1b6f7625cdb0c5a31b0fcca364f"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e7404e276456366ea8d79a6854f7eeed787fa95a0a2be2d86544354631c1d53a"}
{"level":"info","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ec1cd086346e07db13894efba57b4a3c91e5e1b6f7625cdb0c5a31b0fcca364f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T15:59:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3bfcb9078bfab1746d665389fb137bc0788f34a8d0047daab300174662ebf48b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T15:59:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"17de2adb6d944260e5a672a3d74f0089a50aa165ffcd2955e7e4735b79812085","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T15:59:28Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T15:59:28Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["17de2adb6d944260e5a672a3d74f0089a50aa165ffcd2955e7e4735b79812085"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T15:59:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e03fdd5a143a240868123824a24fb7bba9fd12ff84695e5b17caf838dce55d36"}
{"level":"info","ts":"2026-07-22T15:59:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6e75b1e8c62669a4e030b5c130a761e8ab452edb76155e1b661b410b2e99310b"}
{"level":"info","ts":"2026-07-22T15:59:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c2afa9b7e022783f4f938c2c5faae09335fe51fc4b88aabddd96e2cf4153be8e"}
{"level":"info","ts":"2026-07-22T15:59:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"17de2adb6d944260e5a672a3d74f0089a50aa165ffcd2955e7e4735b79812085","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T15:59:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9895548f95df31cd9bab5baf2b2429fae34fc49b852532778cba13ac39b589e3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T15:59:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d41faccd59d1ecdf40a6bebd7377bb6a6fe285547f635ed8f2c9a7dfb0c02536","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T15:59:28Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T15:59:28Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d41faccd59d1ecdf40a6bebd7377bb6a6fe285547f635ed8f2c9a7dfb0c02536"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T15:59:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b16e429af6b757a853fc0e8280dafec3cb2ad1314f4fe0a6f8f90f25334e5622"}
{"level":"info","ts":"2026-07-22T15:59:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/359673a0742083c8f2eb301627aa2befd48230e53a04ddbb14cd674df40ecd99"}
{"level":"info","ts":"2026-07-22T15:59:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d41faccd59d1ecdf40a6bebd7377bb6a6fe285547f635ed8f2c9a7dfb0c02536","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T15:59:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e7404e276456366ea8d79a6854f7eeed787fa95a0a2be2d86544354631c1d53a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T15:59:28Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T15:59:28Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e7404e276456366ea8d79a6854f7eeed787fa95a0a2be2d86544354631c1d53a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T15:59:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ec1cd086346e07db13894efba57b4a3c91e5e1b6f7625cdb0c5a31b0fcca364f"}
{"level":"info","ts":"2026-07-22T15:59:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d8a1f62c712760aa8f013be89ade3264538c41f3a17763d88c503184c87d3481"}
{"level":"info","ts":"2026-07-22T15:59:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/17de2adb6d944260e5a672a3d74f0089a50aa165ffcd2955e7e4735b79812085"}
{"level":"info","ts":"2026-07-22T15:59:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e7404e276456366ea8d79a6854f7eeed787fa95a0a2be2d86544354631c1d53a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T15:59:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e03fdd5a143a240868123824a24fb7bba9fd12ff84695e5b17caf838dce55d36","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T15:59:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6e75b1e8c62669a4e030b5c130a761e8ab452edb76155e1b661b410b2e99310b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T15:59:28Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T15:59:28Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["6e75b1e8c62669a4e030b5c130a761e8ab452edb76155e1b661b410b2e99310b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T15:59:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d41faccd59d1ecdf40a6bebd7377bb6a6fe285547f635ed8f2c9a7dfb0c02536"}
{"level":"info","ts":"2026-07-22T15:59:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e7404e276456366ea8d79a6854f7eeed787fa95a0a2be2d86544354631c1d53a"}
{"level":"info","ts":"2026-07-22T15:59:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6e75b1e8c62669a4e030b5c130a761e8ab452edb76155e1b661b410b2e99310b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T15:59:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c2afa9b7e022783f4f938c2c5faae09335fe51fc4b88aabddd96e2cf4153be8e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T15:59:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b16e429af6b757a853fc0e8280dafec3cb2ad1314f4fe0a6f8f90f25334e5622","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T15:59:28Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T15:59:28Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b16e429af6b757a853fc0e8280dafec3cb2ad1314f4fe0a6f8f90f25334e5622"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T15:59:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6e75b1e8c62669a4e030b5c130a761e8ab452edb76155e1b661b410b2e99310b"}
{"level":"info","ts":"2026-07-22T15:59:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b16e429af6b757a853fc0e8280dafec3cb2ad1314f4fe0a6f8f90f25334e5622","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T15:59:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"359673a0742083c8f2eb301627aa2befd48230e53a04ddbb14cd674df40ecd99","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T15:59:28Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T15:59:28Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["359673a0742083c8f2eb301627aa2befd48230e53a04ddbb14cd674df40ecd99"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T15:59:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b16e429af6b757a853fc0e8280dafec3cb2ad1314f4fe0a6f8f90f25334e5622"}
{"level":"info","ts":"2026-07-22T15:59:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"359673a0742083c8f2eb301627aa2befd48230e53a04ddbb14cd674df40ecd99","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T15:59:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ec1cd086346e07db13894efba57b4a3c91e5e1b6f7625cdb0c5a31b0fcca364f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T15:59:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d8a1f62c712760aa8f013be89ade3264538c41f3a17763d88c503184c87d3481","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T15:59:28Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T15:59:28Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d8a1f62c712760aa8f013be89ade3264538c41f3a17763d88c503184c87d3481"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T15:59:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/359673a0742083c8f2eb301627aa2befd48230e53a04ddbb14cd674df40ecd99"}
{"level":"info","ts":"2026-07-22T15:59:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d8a1f62c712760aa8f013be89ade3264538c41f3a17763d88c503184c87d3481","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T15:59:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"17de2adb6d944260e5a672a3d74f0089a50aa165ffcd2955e7e4735b79812085","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T15:59:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d41faccd59d1ecdf40a6bebd7377bb6a6fe285547f635ed8f2c9a7dfb0c02536","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T15:59:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e7404e276456366ea8d79a6854f7eeed787fa95a0a2be2d86544354631c1d53a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T15:59:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6e75b1e8c62669a4e030b5c130a761e8ab452edb76155e1b661b410b2e99310b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T15:59:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b16e429af6b757a853fc0e8280dafec3cb2ad1314f4fe0a6f8f90f25334e5622","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T15:59:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"359673a0742083c8f2eb301627aa2befd48230e53a04ddbb14cd674df40ecd99","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T15:59:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d8a1f62c712760aa8f013be89ade3264538c41f3a17763d88c503184c87d3481","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-22T15:59:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d8a1f62c712760aa8f013be89ade3264538c41f3a17763d88c503184c87d3481"}
{"level":"info","ts":"2026-07-22T15:59:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ad805a54-227d-4f9c-bf5d-9e515c0944f1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:55792","PortSpecifier":{"PortValue":55792}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ad805a54-227d-4f9c-bf5d-9e515c0944f1","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-290ac7.apps.8aeab84e-a5b3-4a0d-aed2-b31fdb35003a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T15:59:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ad805a54-227d-4f9c-bf5d-9e515c0944f1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:55792","PortSpecifier":{"PortValue":55792}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784735972,"nanos":634937076},"http":{"id":"ad805a54-227d-4f9c-bf5d-9e515c0944f1","method":"POST","headers":{":authority":"e2e-shared-a-290ac7.apps.8aeab84e-a5b3-4a0d-aed2-b31fdb35003a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T15:59:32Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"ad805a54-227d-4f9c-bf5d-9e515c0944f1","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-22T15:59:32Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ad805a54-227d-4f9c-bf5d-9e515c0944f1","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"2016f6dd-6d20-42b2-adc3-6fe1a63178ec","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=645b581d-8e43-4692-85db-bc23b58ffd9d"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/b31fdb35003a"]}}
{"level":"debug","ts":"2026-07-22T15:59:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ad805a54-227d-4f9c-bf5d-9e515c0944f1","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/b31fdb35003a"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=645b581d-8e43-4692-85db-bc23b58ffd9d"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"2016f6dd-6d20-42b2-adc3-6fe1a63178ec","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"559864ad3941b79ccd52fb2dadd5b2fdd0f4290bec91470ec91c5a715996cddb"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.64:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-290ac7.apps.8aeab84e-a5b3-4a0d-aed2-b31fdb35003a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T15:59:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ad805a54-227d-4f9c-bf5d-9e515c0944f1","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T15:59:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ad805a54-227d-4f9c-bf5d-9e515c0944f1","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T15:59:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ad805a54-227d-4f9c-bf5d-9e515c0944f1","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-290ac7/rate-test-model-290ac7\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-290ac7/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T15:59:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"ad805a54-227d-4f9c-bf5d-9e515c0944f1","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-22T15:59:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ad805a54-227d-4f9c-bf5d-9e515c0944f1","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T15:59:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ad805a54-227d-4f9c-bf5d-9e515c0944f1","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-22T15:59:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ad805a54-227d-4f9c-bf5d-9e515c0944f1","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T15:59:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ad805a54-227d-4f9c-bf5d-9e515c0944f1","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T15:59:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"97cfc0f4-7c1a-4e55-828a-cf049ffd44c3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:32990","PortSpecifier":{"PortValue":32990}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.65:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"97cfc0f4-7c1a-4e55-828a-cf049ffd44c3","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-9911b9.apps.8aeab84e-a5b3-4a0d-aed2-b31fdb35003a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T15:59:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"97cfc0f4-7c1a-4e55-828a-cf049ffd44c3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:32990","PortSpecifier":{"PortValue":32990}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.65:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784735972,"nanos":675140336},"http":{"id":"97cfc0f4-7c1a-4e55-828a-cf049ffd44c3","method":"POST","headers":{":authority":"e2e-shared-b-9911b9.apps.8aeab84e-a5b3-4a0d-aed2-b31fdb35003a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T15:59:32Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"97cfc0f4-7c1a-4e55-828a-cf049ffd44c3","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-22T15:59:32Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"97cfc0f4-7c1a-4e55-828a-cf049ffd44c3","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"2016f6dd-6d20-42b2-adc3-6fe1a63178ec","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=645b581d-8e43-4692-85db-bc23b58ffd9d"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/b31fdb35003a"]}}
{"level":"debug","ts":"2026-07-22T15:59:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"97cfc0f4-7c1a-4e55-828a-cf049ffd44c3","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/b31fdb35003a"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=645b581d-8e43-4692-85db-bc23b58ffd9d"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"2016f6dd-6d20-42b2-adc3-6fe1a63178ec","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"d41faccd59d1ecdf40a6bebd7377bb6a6fe285547f635ed8f2c9a7dfb0c02536"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.65:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-9911b9.apps.8aeab84e-a5b3-4a0d-aed2-b31fdb35003a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T15:59:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"97cfc0f4-7c1a-4e55-828a-cf049ffd44c3","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T15:59:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"97cfc0f4-7c1a-4e55-828a-cf049ffd44c3","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T15:59:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"97cfc0f4-7c1a-4e55-828a-cf049ffd44c3","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-9911b9/rate-test-model-9911b9\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-9911b9/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T15:59:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"97cfc0f4-7c1a-4e55-828a-cf049ffd44c3","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-22T15:59:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"97cfc0f4-7c1a-4e55-828a-cf049ffd44c3","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T15:59:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"97cfc0f4-7c1a-4e55-828a-cf049ffd44c3","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-22T15:59:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"97cfc0f4-7c1a-4e55-828a-cf049ffd44c3","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T15:59:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"97cfc0f4-7c1a-4e55-828a-cf049ffd44c3","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T15:59:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d6160a05-323c-4c0d-a569-83885082ac7b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:55794","PortSpecifier":{"PortValue":55794}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d6160a05-323c-4c0d-a569-83885082ac7b","method":"POST","path":"/ai-tenant-e2e-shared-a-290ac7/rate-test-model-290ac7/v1/completions","host":"e2e-shared-a-290ac7.apps.8aeab84e-a5b3-4a0d-aed2-b31fdb35003a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T15:59:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d6160a05-323c-4c0d-a569-83885082ac7b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:55794","PortSpecifier":{"PortValue":55794}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784735972,"nanos":713648365},"http":{"id":"d6160a05-323c-4c0d-a569-83885082ac7b","method":"POST","headers":{":authority":"e2e-shared-a-290ac7.apps.8aeab84e-a5b3-4a0d-aed2-b31fdb35003a.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-290ac7/rate-test-model-290ac7/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T15:59:32Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d6160a05-323c-4c0d-a569-83885082ac7b","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-11yBTxJAdmIaAwQ3I_JYG2I9SMf9594dzMRMSwkEeHhFYOD0GTVEP8djtj9lE"}
{"level":"debug","ts":"2026-07-22T15:59:32Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d6160a05-323c-4c0d-a569-83885082ac7b","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-290ac7.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-11yBTxJAdmIaAwQ3I_JYG2I9SMf9594dzMRMSwkEeHhFYOD0GTVEP8djtj9lE\"}"}
{"level":"debug","ts":"2026-07-22T15:59:32Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d6160a05-323c-4c0d-a569-83885082ac7b","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-290ac7.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"20f1247a-f40b-4911-957d-54260e6c0e87","keyName":"e2e-rate-a-f2f098","subscription":"e2e-rate-iso-a-f2f098","tenant":"e2e-shared-a-290ac7","userId":"20f1247a-f40b-4911-957d-54260e6c0e87","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-22T15:59:32Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d6160a05-323c-4c0d-a569-83885082ac7b","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-290ac7.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-290ac7/rate-test-model-290ac7\",\"requestedSubscription\":\"e2e-rate-iso-a-f2f098\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-22T15:59:32Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d6160a05-323c-4c0d-a569-83885082ac7b","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-290ac7.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-290ac7","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-f2f098","namespace":"ai-tenant-e2e-shared-a-290ac7","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-290ac7/rate-test-model-290ac7"}}
{"level":"debug","ts":"2026-07-22T15:59:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d6160a05-323c-4c0d-a569-83885082ac7b","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T15:59:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d6160a05-323c-4c0d-a569-83885082ac7b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T15:59:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d6160a05-323c-4c0d-a569-83885082ac7b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T15:59:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d6160a05-323c-4c0d-a569-83885082ac7b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-290ac7/rate-test-model-290ac7\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-290ac7/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T15:59:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d6160a05-323c-4c0d-a569-83885082ac7b","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T15:59:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d6160a05-323c-4c0d-a569-83885082ac7b","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T15:59:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d6160a05-323c-4c0d-a569-83885082ac7b","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-f2f098"}
{"level":"debug","ts":"2026-07-22T15:59:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d6160a05-323c-4c0d-a569-83885082ac7b","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T15:59:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d6160a05-323c-4c0d-a569-83885082ac7b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"20f1247a-f40b-4911-957d-54260e6c0e87","keyName":"e2e-rate-a-f2f098","selected_subscription":"e2e-rate-iso-a-f2f098","selected_subscription_key":"ai-tenant-e2e-shared-a-290ac7/e2e-rate-iso-a-f2f098@ai-tenant-e2e-shared-a-290ac7/rate-test-model-290ac7","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-290ac7","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-f2f098","namespace":"ai-tenant-e2e-shared-a-290ac7","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-290ac7/rate-test-model-290ac7"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-22T15:59:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d6160a05-323c-4c0d-a569-83885082ac7b","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T15:59:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d6160a05-323c-4c0d-a569-83885082ac7b","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T15:59:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2b623758-272c-4c9d-a0e6-7c5ab34c6df5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:55800","PortSpecifier":{"PortValue":55800}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2b623758-272c-4c9d-a0e6-7c5ab34c6df5","method":"POST","path":"/ai-tenant-e2e-shared-a-290ac7/rate-test-model-290ac7/v1/completions","host":"e2e-shared-a-290ac7.apps.8aeab84e-a5b3-4a0d-aed2-b31fdb35003a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T15:59:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2b623758-272c-4c9d-a0e6-7c5ab34c6df5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:55800","PortSpecifier":{"PortValue":55800}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784735973,"nanos":762610098},"http":{"id":"2b623758-272c-4c9d-a0e6-7c5ab34c6df5","method":"POST","headers":{":authority":"e2e-shared-a-290ac7.apps.8aeab84e-a5b3-4a0d-aed2-b31fdb35003a.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-290ac7/rate-test-model-290ac7/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T15:59:33Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2b623758-272c-4c9d-a0e6-7c5ab34c6df5","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-11yBTxJAdmIaAwQ3I_JYG2I9SMf9594dzMRMSwkEeHhFYOD0GTVEP8djtj9lE"}
{"level":"debug","ts":"2026-07-22T15:59:33Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2b623758-272c-4c9d-a0e6-7c5ab34c6df5","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-290ac7.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-11yBTxJAdmIaAwQ3I_JYG2I9SMf9594dzMRMSwkEeHhFYOD0GTVEP8djtj9lE\"}"}
{"level":"debug","ts":"2026-07-22T15:59:33Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2b623758-272c-4c9d-a0e6-7c5ab34c6df5","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-290ac7.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"20f1247a-f40b-4911-957d-54260e6c0e87","keyName":"e2e-rate-a-f2f098","subscription":"e2e-rate-iso-a-f2f098","tenant":"e2e-shared-a-290ac7","userId":"20f1247a-f40b-4911-957d-54260e6c0e87","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-22T15:59:33Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2b623758-272c-4c9d-a0e6-7c5ab34c6df5","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-290ac7.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-290ac7/rate-test-model-290ac7\",\"requestedSubscription\":\"e2e-rate-iso-a-f2f098\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-22T15:59:33Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2b623758-272c-4c9d-a0e6-7c5ab34c6df5","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-290ac7.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-290ac7","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-f2f098","namespace":"ai-tenant-e2e-shared-a-290ac7","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-290ac7/rate-test-model-290ac7"}}
{"level":"debug","ts":"2026-07-22T15:59:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2b623758-272c-4c9d-a0e6-7c5ab34c6df5","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T15:59:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2b623758-272c-4c9d-a0e6-7c5ab34c6df5","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T15:59:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2b623758-272c-4c9d-a0e6-7c5ab34c6df5","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T15:59:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2b623758-272c-4c9d-a0e6-7c5ab34c6df5","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-290ac7/rate-test-model-290ac7\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-290ac7/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T15:59:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2b623758-272c-4c9d-a0e6-7c5ab34c6df5","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T15:59:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2b623758-272c-4c9d-a0e6-7c5ab34c6df5","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T15:59:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2b623758-272c-4c9d-a0e6-7c5ab34c6df5","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T15:59:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2b623758-272c-4c9d-a0e6-7c5ab34c6df5","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-f2f098"}
{"level":"debug","ts":"2026-07-22T15:59:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2b623758-272c-4c9d-a0e6-7c5ab34c6df5","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"20f1247a-f40b-4911-957d-54260e6c0e87","keyName":"e2e-rate-a-f2f098","selected_subscription":"e2e-rate-iso-a-f2f098","selected_subscription_key":"ai-tenant-e2e-shared-a-290ac7/e2e-rate-iso-a-f2f098@ai-tenant-e2e-shared-a-290ac7/rate-test-model-290ac7","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-290ac7","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-f2f098","namespace":"ai-tenant-e2e-shared-a-290ac7","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-290ac7/rate-test-model-290ac7"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-22T15:59:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2b623758-272c-4c9d-a0e6-7c5ab34c6df5","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T15:59:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2b623758-272c-4c9d-a0e6-7c5ab34c6df5","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T15:59:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"72676f4c-215c-43e3-be81-7cd20f2fe898","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:55808","PortSpecifier":{"PortValue":55808}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"72676f4c-215c-43e3-be81-7cd20f2fe898","method":"POST","path":"/ai-tenant-e2e-shared-a-290ac7/rate-test-model-290ac7/v1/completions","host":"e2e-shared-a-290ac7.apps.8aeab84e-a5b3-4a0d-aed2-b31fdb35003a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T15:59:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"72676f4c-215c-43e3-be81-7cd20f2fe898","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:55808","PortSpecifier":{"PortValue":55808}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784735974,"nanos":801886909},"http":{"id":"72676f4c-215c-43e3-be81-7cd20f2fe898","method":"POST","headers":{":authority":"e2e-shared-a-290ac7.apps.8aeab84e-a5b3-4a0d-aed2-b31fdb35003a.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-290ac7/rate-test-model-290ac7/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T15:59:34Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"72676f4c-215c-43e3-be81-7cd20f2fe898","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-11yBTxJAdmIaAwQ3I_JYG2I9SMf9594dzMRMSwkEeHhFYOD0GTVEP8djtj9lE"}
{"level":"debug","ts":"2026-07-22T15:59:34Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"72676f4c-215c-43e3-be81-7cd20f2fe898","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-290ac7.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-11yBTxJAdmIaAwQ3I_JYG2I9SMf9594dzMRMSwkEeHhFYOD0GTVEP8djtj9lE\"}"}
{"level":"debug","ts":"2026-07-22T15:59:34Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"72676f4c-215c-43e3-be81-7cd20f2fe898","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-290ac7.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"20f1247a-f40b-4911-957d-54260e6c0e87","keyName":"e2e-rate-a-f2f098","subscription":"e2e-rate-iso-a-f2f098","tenant":"e2e-shared-a-290ac7","userId":"20f1247a-f40b-4911-957d-54260e6c0e87","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-22T15:59:34Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"72676f4c-215c-43e3-be81-7cd20f2fe898","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-290ac7.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-290ac7/rate-test-model-290ac7\",\"requestedSubscription\":\"e2e-rate-iso-a-f2f098\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-22T15:59:34Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"72676f4c-215c-43e3-be81-7cd20f2fe898","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-290ac7.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-290ac7","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-f2f098","namespace":"ai-tenant-e2e-shared-a-290ac7","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-290ac7/rate-test-model-290ac7"}}
{"level":"debug","ts":"2026-07-22T15:59:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"72676f4c-215c-43e3-be81-7cd20f2fe898","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T15:59:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"72676f4c-215c-43e3-be81-7cd20f2fe898","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T15:59:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"72676f4c-215c-43e3-be81-7cd20f2fe898","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T15:59:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"72676f4c-215c-43e3-be81-7cd20f2fe898","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-290ac7/rate-test-model-290ac7\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-290ac7/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T15:59:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"72676f4c-215c-43e3-be81-7cd20f2fe898","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T15:59:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"72676f4c-215c-43e3-be81-7cd20f2fe898","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T15:59:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"72676f4c-215c-43e3-be81-7cd20f2fe898","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-f2f098"}
{"level":"debug","ts":"2026-07-22T15:59:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"72676f4c-215c-43e3-be81-7cd20f2fe898","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T15:59:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"72676f4c-215c-43e3-be81-7cd20f2fe898","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"20f1247a-f40b-4911-957d-54260e6c0e87","keyName":"e2e-rate-a-f2f098","selected_subscription":"e2e-rate-iso-a-f2f098","selected_subscription_key":"ai-tenant-e2e-shared-a-290ac7/e2e-rate-iso-a-f2f098@ai-tenant-e2e-shared-a-290ac7/rate-test-model-290ac7","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-290ac7","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-f2f098","namespace":"ai-tenant-e2e-shared-a-290ac7","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-290ac7/rate-test-model-290ac7"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-22T15:59:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"72676f4c-215c-43e3-be81-7cd20f2fe898","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T15:59:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"72676f4c-215c-43e3-be81-7cd20f2fe898","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T15:59:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e89374f5-4d66-424b-9c65-af5ebefe7192","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:55812","PortSpecifier":{"PortValue":55812}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e89374f5-4d66-424b-9c65-af5ebefe7192","method":"POST","path":"/ai-tenant-e2e-shared-a-290ac7/rate-test-model-290ac7/v1/completions","host":"e2e-shared-a-290ac7.apps.8aeab84e-a5b3-4a0d-aed2-b31fdb35003a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T15:59:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e89374f5-4d66-424b-9c65-af5ebefe7192","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:55812","PortSpecifier":{"PortValue":55812}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784735975,"nanos":836018455},"http":{"id":"e89374f5-4d66-424b-9c65-af5ebefe7192","method":"POST","headers":{":authority":"e2e-shared-a-290ac7.apps.8aeab84e-a5b3-4a0d-aed2-b31fdb35003a.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-290ac7/rate-test-model-290ac7/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T15:59:35Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e89374f5-4d66-424b-9c65-af5ebefe7192","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-11yBTxJAdmIaAwQ3I_JYG2I9SMf9594dzMRMSwkEeHhFYOD0GTVEP8djtj9lE"}
{"level":"debug","ts":"2026-07-22T15:59:35Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e89374f5-4d66-424b-9c65-af5ebefe7192","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-290ac7.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-11yBTxJAdmIaAwQ3I_JYG2I9SMf9594dzMRMSwkEeHhFYOD0GTVEP8djtj9lE\"}"}
{"level":"debug","ts":"2026-07-22T15:59:35Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e89374f5-4d66-424b-9c65-af5ebefe7192","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-290ac7.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"20f1247a-f40b-4911-957d-54260e6c0e87","keyName":"e2e-rate-a-f2f098","subscription":"e2e-rate-iso-a-f2f098","tenant":"e2e-shared-a-290ac7","userId":"20f1247a-f40b-4911-957d-54260e6c0e87","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-22T15:59:35Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e89374f5-4d66-424b-9c65-af5ebefe7192","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-290ac7.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-290ac7/rate-test-model-290ac7\",\"requestedSubscription\":\"e2e-rate-iso-a-f2f098\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-22T15:59:35Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e89374f5-4d66-424b-9c65-af5ebefe7192","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-290ac7.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-290ac7","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-f2f098","namespace":"ai-tenant-e2e-shared-a-290ac7","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-290ac7/rate-test-model-290ac7"}}
{"level":"debug","ts":"2026-07-22T15:59:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e89374f5-4d66-424b-9c65-af5ebefe7192","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T15:59:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e89374f5-4d66-424b-9c65-af5ebefe7192","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T15:59:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e89374f5-4d66-424b-9c65-af5ebefe7192","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T15:59:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e89374f5-4d66-424b-9c65-af5ebefe7192","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-290ac7/rate-test-model-290ac7\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-290ac7/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T15:59:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e89374f5-4d66-424b-9c65-af5ebefe7192","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T15:59:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e89374f5-4d66-424b-9c65-af5ebefe7192","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-f2f098"}
{"level":"debug","ts":"2026-07-22T15:59:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e89374f5-4d66-424b-9c65-af5ebefe7192","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T15:59:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e89374f5-4d66-424b-9c65-af5ebefe7192","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T15:59:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e89374f5-4d66-424b-9c65-af5ebefe7192","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"20f1247a-f40b-4911-957d-54260e6c0e87","keyName":"e2e-rate-a-f2f098","selected_subscription":"e2e-rate-iso-a-f2f098","selected_subscription_key":"ai-tenant-e2e-shared-a-290ac7/e2e-rate-iso-a-f2f098@ai-tenant-e2e-shared-a-290ac7/rate-test-model-290ac7","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-290ac7","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-f2f098","namespace":"ai-tenant-e2e-shared-a-290ac7","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-290ac7/rate-test-model-290ac7"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-22T15:59:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e89374f5-4d66-424b-9c65-af5ebefe7192","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T15:59:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e89374f5-4d66-424b-9c65-af5ebefe7192","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T15:59:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6507550f-bbbe-469f-b747-40fabf522ff8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:53584","PortSpecifier":{"PortValue":53584}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6507550f-bbbe-469f-b747-40fabf522ff8","method":"POST","path":"/ai-tenant-e2e-shared-a-290ac7/rate-test-model-290ac7/v1/completions","host":"e2e-shared-a-290ac7.apps.8aeab84e-a5b3-4a0d-aed2-b31fdb35003a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T15:59:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6507550f-bbbe-469f-b747-40fabf522ff8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:53584","PortSpecifier":{"PortValue":53584}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784735976,"nanos":871987285},"http":{"id":"6507550f-bbbe-469f-b747-40fabf522ff8","method":"POST","headers":{":authority":"e2e-shared-a-290ac7.apps.8aeab84e-a5b3-4a0d-aed2-b31fdb35003a.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-290ac7/rate-test-model-290ac7/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T15:59:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6507550f-bbbe-469f-b747-40fabf522ff8","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-11yBTxJAdmIaAwQ3I_JYG2I9SMf9594dzMRMSwkEeHhFYOD0GTVEP8djtj9lE"}
{"level":"debug","ts":"2026-07-22T15:59:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6507550f-bbbe-469f-b747-40fabf522ff8","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-290ac7.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-11yBTxJAdmIaAwQ3I_JYG2I9SMf9594dzMRMSwkEeHhFYOD0GTVEP8djtj9lE\"}"}
{"level":"debug","ts":"2026-07-22T15:59:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6507550f-bbbe-469f-b747-40fabf522ff8","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-290ac7.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"20f1247a-f40b-4911-957d-54260e6c0e87","keyName":"e2e-rate-a-f2f098","subscription":"e2e-rate-iso-a-f2f098","tenant":"e2e-shared-a-290ac7","userId":"20f1247a-f40b-4911-957d-54260e6c0e87","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-22T15:59:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6507550f-bbbe-469f-b747-40fabf522ff8","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-290ac7.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-290ac7/rate-test-model-290ac7\",\"requestedSubscription\":\"e2e-rate-iso-a-f2f098\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-22T15:59:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6507550f-bbbe-469f-b747-40fabf522ff8","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-290ac7.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-290ac7","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-f2f098","namespace":"ai-tenant-e2e-shared-a-290ac7","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-290ac7/rate-test-model-290ac7"}}
{"level":"debug","ts":"2026-07-22T15:59:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6507550f-bbbe-469f-b747-40fabf522ff8","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T15:59:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6507550f-bbbe-469f-b747-40fabf522ff8","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T15:59:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6507550f-bbbe-469f-b747-40fabf522ff8","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T15:59:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6507550f-bbbe-469f-b747-40fabf522ff8","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-290ac7/rate-test-model-290ac7\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-290ac7/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T15:59:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6507550f-bbbe-469f-b747-40fabf522ff8","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T15:59:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6507550f-bbbe-469f-b747-40fabf522ff8","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T15:59:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6507550f-bbbe-469f-b747-40fabf522ff8","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-f2f098"}
{"level":"debug","ts":"2026-07-22T15:59:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6507550f-bbbe-469f-b747-40fabf522ff8","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T15:59:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6507550f-bbbe-469f-b747-40fabf522ff8","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"20f1247a-f40b-4911-957d-54260e6c0e87","keyName":"e2e-rate-a-f2f098","selected_subscription":"e2e-rate-iso-a-f2f098","selected_subscription_key":"ai-tenant-e2e-shared-a-290ac7/e2e-rate-iso-a-f2f098@ai-tenant-e2e-shared-a-290ac7/rate-test-model-290ac7","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-290ac7","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-f2f098","namespace":"ai-tenant-e2e-shared-a-290ac7","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-290ac7/rate-test-model-290ac7"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-22T15:59:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6507550f-bbbe-469f-b747-40fabf522ff8","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T15:59:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6507550f-bbbe-469f-b747-40fabf522ff8","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T15:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"315ac4fd-d1e4-4385-815c-326eff9c9f2f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:53586","PortSpecifier":{"PortValue":53586}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"315ac4fd-d1e4-4385-815c-326eff9c9f2f","method":"POST","path":"/ai-tenant-e2e-shared-a-290ac7/rate-test-model-290ac7/v1/completions","host":"e2e-shared-a-290ac7.apps.8aeab84e-a5b3-4a0d-aed2-b31fdb35003a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T15:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"315ac4fd-d1e4-4385-815c-326eff9c9f2f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:53586","PortSpecifier":{"PortValue":53586}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784735977,"nanos":908758301},"http":{"id":"315ac4fd-d1e4-4385-815c-326eff9c9f2f","method":"POST","headers":{":authority":"e2e-shared-a-290ac7.apps.8aeab84e-a5b3-4a0d-aed2-b31fdb35003a.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-290ac7/rate-test-model-290ac7/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T15:59:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"315ac4fd-d1e4-4385-815c-326eff9c9f2f","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-11yBTxJAdmIaAwQ3I_JYG2I9SMf9594dzMRMSwkEeHhFYOD0GTVEP8djtj9lE"}
{"level":"debug","ts":"2026-07-22T15:59:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"315ac4fd-d1e4-4385-815c-326eff9c9f2f","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-290ac7.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-11yBTxJAdmIaAwQ3I_JYG2I9SMf9594dzMRMSwkEeHhFYOD0GTVEP8djtj9lE\"}"}
{"level":"debug","ts":"2026-07-22T15:59:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"315ac4fd-d1e4-4385-815c-326eff9c9f2f","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-290ac7.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"20f1247a-f40b-4911-957d-54260e6c0e87","keyName":"e2e-rate-a-f2f098","subscription":"e2e-rate-iso-a-f2f098","tenant":"e2e-shared-a-290ac7","userId":"20f1247a-f40b-4911-957d-54260e6c0e87","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-22T15:59:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"315ac4fd-d1e4-4385-815c-326eff9c9f2f","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-290ac7.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-290ac7/rate-test-model-290ac7\",\"requestedSubscription\":\"e2e-rate-iso-a-f2f098\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-22T15:59:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"315ac4fd-d1e4-4385-815c-326eff9c9f2f","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-290ac7.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-290ac7","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-f2f098","namespace":"ai-tenant-e2e-shared-a-290ac7","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-290ac7/rate-test-model-290ac7"}}
{"level":"debug","ts":"2026-07-22T15:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"315ac4fd-d1e4-4385-815c-326eff9c9f2f","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T15:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"315ac4fd-d1e4-4385-815c-326eff9c9f2f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T15:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"315ac4fd-d1e4-4385-815c-326eff9c9f2f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T15:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"315ac4fd-d1e4-4385-815c-326eff9c9f2f","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T15:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"315ac4fd-d1e4-4385-815c-326eff9c9f2f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-290ac7/rate-test-model-290ac7\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-290ac7/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T15:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"315ac4fd-d1e4-4385-815c-326eff9c9f2f","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T15:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"315ac4fd-d1e4-4385-815c-326eff9c9f2f","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-f2f098"}
{"level":"debug","ts":"2026-07-22T15:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"315ac4fd-d1e4-4385-815c-326eff9c9f2f","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T15:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"315ac4fd-d1e4-4385-815c-326eff9c9f2f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"20f1247a-f40b-4911-957d-54260e6c0e87","keyName":"e2e-rate-a-f2f098","selected_subscription":"e2e-rate-iso-a-f2f098","selected_subscription_key":"ai-tenant-e2e-shared-a-290ac7/e2e-rate-iso-a-f2f098@ai-tenant-e2e-shared-a-290ac7/rate-test-model-290ac7","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-290ac7","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-f2f098","namespace":"ai-tenant-e2e-shared-a-290ac7","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-290ac7/rate-test-model-290ac7"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-22T15:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"315ac4fd-d1e4-4385-815c-326eff9c9f2f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T15:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"315ac4fd-d1e4-4385-815c-326eff9c9f2f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T15:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5e02d861-e811-4c52-9c34-dfb9d1beff48","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:53600","PortSpecifier":{"PortValue":53600}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5e02d861-e811-4c52-9c34-dfb9d1beff48","method":"POST","path":"/ai-tenant-e2e-shared-a-290ac7/rate-test-model-290ac7/v1/completions","host":"e2e-shared-a-290ac7.apps.8aeab84e-a5b3-4a0d-aed2-b31fdb35003a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T15:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5e02d861-e811-4c52-9c34-dfb9d1beff48","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:53600","PortSpecifier":{"PortValue":53600}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784735978,"nanos":949386522},"http":{"id":"5e02d861-e811-4c52-9c34-dfb9d1beff48","method":"POST","headers":{":authority":"e2e-shared-a-290ac7.apps.8aeab84e-a5b3-4a0d-aed2-b31fdb35003a.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-290ac7/rate-test-model-290ac7/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T15:59:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5e02d861-e811-4c52-9c34-dfb9d1beff48","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-11yBTxJAdmIaAwQ3I_JYG2I9SMf9594dzMRMSwkEeHhFYOD0GTVEP8djtj9lE"}
{"level":"debug","ts":"2026-07-22T15:59:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5e02d861-e811-4c52-9c34-dfb9d1beff48","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-290ac7.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-11yBTxJAdmIaAwQ3I_JYG2I9SMf9594dzMRMSwkEeHhFYOD0GTVEP8djtj9lE\"}"}
{"level":"debug","ts":"2026-07-22T15:59:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5e02d861-e811-4c52-9c34-dfb9d1beff48","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-290ac7.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"20f1247a-f40b-4911-957d-54260e6c0e87","keyName":"e2e-rate-a-f2f098","subscription":"e2e-rate-iso-a-f2f098","tenant":"e2e-shared-a-290ac7","userId":"20f1247a-f40b-4911-957d-54260e6c0e87","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-22T15:59:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5e02d861-e811-4c52-9c34-dfb9d1beff48","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-290ac7.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-290ac7/rate-test-model-290ac7\",\"requestedSubscription\":\"e2e-rate-iso-a-f2f098\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-22T15:59:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5e02d861-e811-4c52-9c34-dfb9d1beff48","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-290ac7.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-290ac7","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-f2f098","namespace":"ai-tenant-e2e-shared-a-290ac7","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-290ac7/rate-test-model-290ac7"}}
{"level":"debug","ts":"2026-07-22T15:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5e02d861-e811-4c52-9c34-dfb9d1beff48","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T15:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5e02d861-e811-4c52-9c34-dfb9d1beff48","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T15:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5e02d861-e811-4c52-9c34-dfb9d1beff48","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T15:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5e02d861-e811-4c52-9c34-dfb9d1beff48","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-290ac7/rate-test-model-290ac7\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-290ac7/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T15:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5e02d861-e811-4c52-9c34-dfb9d1beff48","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T15:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5e02d861-e811-4c52-9c34-dfb9d1beff48","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T15:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5e02d861-e811-4c52-9c34-dfb9d1beff48","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-f2f098"}
{"level":"debug","ts":"2026-07-22T15:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5e02d861-e811-4c52-9c34-dfb9d1beff48","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T15:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5e02d861-e811-4c52-9c34-dfb9d1beff48","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"20f1247a-f40b-4911-957d-54260e6c0e87","keyName":"e2e-rate-a-f2f098","selected_subscription":"e2e-rate-iso-a-f2f098","selected_subscription_key":"ai-tenant-e2e-shared-a-290ac7/e2e-rate-iso-a-f2f098@ai-tenant-e2e-shared-a-290ac7/rate-test-model-290ac7","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-290ac7","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-f2f098","namespace":"ai-tenant-e2e-shared-a-290ac7","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-290ac7/rate-test-model-290ac7"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-22T15:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5e02d861-e811-4c52-9c34-dfb9d1beff48","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T15:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5e02d861-e811-4c52-9c34-dfb9d1beff48","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T15:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"30ed4293-b150-4b37-9b75-2946ad2c7544","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:53612","PortSpecifier":{"PortValue":53612}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"30ed4293-b150-4b37-9b75-2946ad2c7544","method":"POST","path":"/ai-tenant-e2e-shared-a-290ac7/rate-test-model-290ac7/v1/completions","host":"e2e-shared-a-290ac7.apps.8aeab84e-a5b3-4a0d-aed2-b31fdb35003a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T15:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"30ed4293-b150-4b37-9b75-2946ad2c7544","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:53612","PortSpecifier":{"PortValue":53612}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784735979,"nanos":986537165},"http":{"id":"30ed4293-b150-4b37-9b75-2946ad2c7544","method":"POST","headers":{":authority":"e2e-shared-a-290ac7.apps.8aeab84e-a5b3-4a0d-aed2-b31fdb35003a.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-290ac7/rate-test-model-290ac7/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T15:59:39Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"30ed4293-b150-4b37-9b75-2946ad2c7544","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-11yBTxJAdmIaAwQ3I_JYG2I9SMf9594dzMRMSwkEeHhFYOD0GTVEP8djtj9lE"}
{"level":"debug","ts":"2026-07-22T15:59:39Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"30ed4293-b150-4b37-9b75-2946ad2c7544","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-290ac7.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-11yBTxJAdmIaAwQ3I_JYG2I9SMf9594dzMRMSwkEeHhFYOD0GTVEP8djtj9lE\"}"}
{"level":"debug","ts":"2026-07-22T15:59:39Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"30ed4293-b150-4b37-9b75-2946ad2c7544","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-290ac7.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"20f1247a-f40b-4911-957d-54260e6c0e87","keyName":"e2e-rate-a-f2f098","subscription":"e2e-rate-iso-a-f2f098","tenant":"e2e-shared-a-290ac7","userId":"20f1247a-f40b-4911-957d-54260e6c0e87","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-22T15:59:39Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"30ed4293-b150-4b37-9b75-2946ad2c7544","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-290ac7.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-290ac7/rate-test-model-290ac7\",\"requestedSubscription\":\"e2e-rate-iso-a-f2f098\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-22T15:59:39Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"30ed4293-b150-4b37-9b75-2946ad2c7544","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-290ac7.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-290ac7","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-f2f098","namespace":"ai-tenant-e2e-shared-a-290ac7","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-290ac7/rate-test-model-290ac7"}}
{"level":"debug","ts":"2026-07-22T15:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"30ed4293-b150-4b37-9b75-2946ad2c7544","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T15:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"30ed4293-b150-4b37-9b75-2946ad2c7544","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T15:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"30ed4293-b150-4b37-9b75-2946ad2c7544","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T15:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"30ed4293-b150-4b37-9b75-2946ad2c7544","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T15:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"30ed4293-b150-4b37-9b75-2946ad2c7544","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-290ac7/rate-test-model-290ac7\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-290ac7/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T15:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"30ed4293-b150-4b37-9b75-2946ad2c7544","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T15:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"30ed4293-b150-4b37-9b75-2946ad2c7544","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T15:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"30ed4293-b150-4b37-9b75-2946ad2c7544","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-f2f098"}
{"level":"debug","ts":"2026-07-22T15:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"30ed4293-b150-4b37-9b75-2946ad2c7544","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"20f1247a-f40b-4911-957d-54260e6c0e87","keyName":"e2e-rate-a-f2f098","selected_subscription":"e2e-rate-iso-a-f2f098","selected_subscription_key":"ai-tenant-e2e-shared-a-290ac7/e2e-rate-iso-a-f2f098@ai-tenant-e2e-shared-a-290ac7/rate-test-model-290ac7","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-290ac7","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-f2f098","namespace":"ai-tenant-e2e-shared-a-290ac7","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-290ac7/rate-test-model-290ac7"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-22T15:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"30ed4293-b150-4b37-9b75-2946ad2c7544","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T15:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"30ed4293-b150-4b37-9b75-2946ad2c7544","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T15:59:48Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fef008df-2c4d-4611-bb96-a0a3c00697f9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:38618","PortSpecifier":{"PortValue":38618}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"fef008df-2c4d-4611-bb96-a0a3c00697f9","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-290ac7.apps.8aeab84e-a5b3-4a0d-aed2-b31fdb35003a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T15:59:48Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fef008df-2c4d-4611-bb96-a0a3c00697f9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:38618","PortSpecifier":{"PortValue":38618}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784735988,"nanos":746096029},"http":{"id":"fef008df-2c4d-4611-bb96-a0a3c00697f9","method":"POST","headers":{":authority":"e2e-shared-a-290ac7.apps.8aeab84e-a5b3-4a0d-aed2-b31fdb35003a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T15:59:48Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"fef008df-2c4d-4611-bb96-a0a3c00697f9","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-22T15:59:48Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"fef008df-2c4d-4611-bb96-a0a3c00697f9","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"2016f6dd-6d20-42b2-adc3-6fe1a63178ec","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=645b581d-8e43-4692-85db-bc23b58ffd9d"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/b31fdb35003a"]}}
{"level":"debug","ts":"2026-07-22T15:59:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"fef008df-2c4d-4611-bb96-a0a3c00697f9","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/b31fdb35003a"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=645b581d-8e43-4692-85db-bc23b58ffd9d"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"2016f6dd-6d20-42b2-adc3-6fe1a63178ec","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"559864ad3941b79ccd52fb2dadd5b2fdd0f4290bec91470ec91c5a715996cddb"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.64:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-290ac7.apps.8aeab84e-a5b3-4a0d-aed2-b31fdb35003a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T15:59:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fef008df-2c4d-4611-bb96-a0a3c00697f9","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T15:59:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fef008df-2c4d-4611-bb96-a0a3c00697f9","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T15:59:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fef008df-2c4d-4611-bb96-a0a3c00697f9","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-290ac7/rate-test-model-290ac7\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-290ac7/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T15:59:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"fef008df-2c4d-4611-bb96-a0a3c00697f9","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-22T15:59:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fef008df-2c4d-4611-bb96-a0a3c00697f9","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T15:59:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fef008df-2c4d-4611-bb96-a0a3c00697f9","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-22T15:59:48Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fef008df-2c4d-4611-bb96-a0a3c00697f9","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T15:59:48Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fef008df-2c4d-4611-bb96-a0a3c00697f9","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T15:59:48Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"379125bf-5991-44c5-9704-0d9d24835e22","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:39480","PortSpecifier":{"PortValue":39480}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.65:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"379125bf-5991-44c5-9704-0d9d24835e22","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-9911b9.apps.8aeab84e-a5b3-4a0d-aed2-b31fdb35003a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T15:59:48Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"379125bf-5991-44c5-9704-0d9d24835e22","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:39480","PortSpecifier":{"PortValue":39480}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.65:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784735988,"nanos":786074805},"http":{"id":"379125bf-5991-44c5-9704-0d9d24835e22","method":"POST","headers":{":authority":"e2e-shared-b-9911b9.apps.8aeab84e-a5b3-4a0d-aed2-b31fdb35003a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T15:59:48Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"379125bf-5991-44c5-9704-0d9d24835e22","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-22T15:59:48Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"379125bf-5991-44c5-9704-0d9d24835e22","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"2016f6dd-6d20-42b2-adc3-6fe1a63178ec","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=645b581d-8e43-4692-85db-bc23b58ffd9d"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/b31fdb35003a"]}}
{"level":"debug","ts":"2026-07-22T15:59:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"379125bf-5991-44c5-9704-0d9d24835e22","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/b31fdb35003a"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=645b581d-8e43-4692-85db-bc23b58ffd9d"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"2016f6dd-6d20-42b2-adc3-6fe1a63178ec","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"d41faccd59d1ecdf40a6bebd7377bb6a6fe285547f635ed8f2c9a7dfb0c02536"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.65:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-9911b9.apps.8aeab84e-a5b3-4a0d-aed2-b31fdb35003a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T15:59:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"379125bf-5991-44c5-9704-0d9d24835e22","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T15:59:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"379125bf-5991-44c5-9704-0d9d24835e22","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T15:59:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"379125bf-5991-44c5-9704-0d9d24835e22","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-9911b9/rate-test-model-9911b9\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-9911b9/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T15:59:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"379125bf-5991-44c5-9704-0d9d24835e22","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-22T15:59:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"379125bf-5991-44c5-9704-0d9d24835e22","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T15:59:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"379125bf-5991-44c5-9704-0d9d24835e22","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-22T15:59:48Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"379125bf-5991-44c5-9704-0d9d24835e22","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T15:59:48Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"379125bf-5991-44c5-9704-0d9d24835e22","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T15:59:48Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d5e319c4-b466-4cfc-9c91-d5f6ca2ed37b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:38622","PortSpecifier":{"PortValue":38622}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d5e319c4-b466-4cfc-9c91-d5f6ca2ed37b","method":"POST","path":"/ai-tenant-e2e-shared-a-290ac7/rate-test-model-290ac7/v1/completions","host":"e2e-shared-a-290ac7.apps.8aeab84e-a5b3-4a0d-aed2-b31fdb35003a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T15:59:48Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d5e319c4-b466-4cfc-9c91-d5f6ca2ed37b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:38622","PortSpecifier":{"PortValue":38622}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784735988,"nanos":820873898},"http":{"id":"d5e319c4-b466-4cfc-9c91-d5f6ca2ed37b","method":"POST","headers":{":authority":"e2e-shared-a-290ac7.apps.8aeab84e-a5b3-4a0d-aed2-b31fdb35003a.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-290ac7/rate-test-model-290ac7/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T15:59:48Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d5e319c4-b466-4cfc-9c91-d5f6ca2ed37b","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-mGwrdZImihD3TTLl_QpVSMphtCEVz4p6vhDbkxgx56wZDLuj7ream4uS2sSH"}
{"level":"debug","ts":"2026-07-22T15:59:48Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d5e319c4-b466-4cfc-9c91-d5f6ca2ed37b","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-290ac7.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-mGwrdZImihD3TTLl_QpVSMphtCEVz4p6vhDbkxgx56wZDLuj7ream4uS2sSH\"}"}
{"level":"debug","ts":"2026-07-22T15:59:48Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d5e319c4-b466-4cfc-9c91-d5f6ca2ed37b","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-290ac7.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"dfa9a3e2-19c7-4a58-8c0a-23d857fe7d47","keyName":"e2e-rate-a-81c647","subscription":"e2e-rate-iso-a-81c647","tenant":"e2e-shared-a-290ac7","userId":"dfa9a3e2-19c7-4a58-8c0a-23d857fe7d47","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-22T15:59:48Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d5e319c4-b466-4cfc-9c91-d5f6ca2ed37b","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-290ac7.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-290ac7/rate-test-model-290ac7\",\"requestedSubscription\":\"e2e-rate-iso-a-81c647\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-22T15:59:48Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d5e319c4-b466-4cfc-9c91-d5f6ca2ed37b","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-290ac7.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-290ac7","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-81c647","namespace":"ai-tenant-e2e-shared-a-290ac7","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-290ac7/rate-test-model-290ac7"}}
{"level":"debug","ts":"2026-07-22T15:59:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d5e319c4-b466-4cfc-9c91-d5f6ca2ed37b","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T15:59:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d5e319c4-b466-4cfc-9c91-d5f6ca2ed37b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T15:59:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d5e319c4-b466-4cfc-9c91-d5f6ca2ed37b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T15:59:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d5e319c4-b466-4cfc-9c91-d5f6ca2ed37b","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T15:59:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d5e319c4-b466-4cfc-9c91-d5f6ca2ed37b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-290ac7/rate-test-model-290ac7\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-290ac7/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T15:59:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d5e319c4-b466-4cfc-9c91-d5f6ca2ed37b","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T15:59:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d5e319c4-b466-4cfc-9c91-d5f6ca2ed37b","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-81c647"}
{"level":"debug","ts":"2026-07-22T15:59:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d5e319c4-b466-4cfc-9c91-d5f6ca2ed37b","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T15:59:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d5e319c4-b466-4cfc-9c91-d5f6ca2ed37b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"dfa9a3e2-19c7-4a58-8c0a-23d857fe7d47","keyName":"e2e-rate-a-81c647","selected_subscription":"e2e-rate-iso-a-81c647","selected_subscription_key":"ai-tenant-e2e-shared-a-290ac7/e2e-rate-iso-a-81c647@ai-tenant-e2e-shared-a-290ac7/rate-test-model-290ac7","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-290ac7","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-81c647","namespace":"ai-tenant-e2e-shared-a-290ac7","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-290ac7/rate-test-model-290ac7"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-22T15:59:48Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d5e319c4-b466-4cfc-9c91-d5f6ca2ed37b","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T15:59:48Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d5e319c4-b466-4cfc-9c91-d5f6ca2ed37b","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T15:59:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d5706d0e-3448-45e7-9cc2-988a87794de7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:38624","PortSpecifier":{"PortValue":38624}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d5706d0e-3448-45e7-9cc2-988a87794de7","method":"POST","path":"/ai-tenant-e2e-shared-a-290ac7/rate-test-model-290ac7/v1/completions","host":"e2e-shared-a-290ac7.apps.8aeab84e-a5b3-4a0d-aed2-b31fdb35003a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T15:59:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d5706d0e-3448-45e7-9cc2-988a87794de7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:38624","PortSpecifier":{"PortValue":38624}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784735989,"nanos":857498251},"http":{"id":"d5706d0e-3448-45e7-9cc2-988a87794de7","method":"POST","headers":{":authority":"e2e-shared-a-290ac7.apps.8aeab84e-a5b3-4a0d-aed2-b31fdb35003a.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-290ac7/rate-test-model-290ac7/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T15:59:49Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d5706d0e-3448-45e7-9cc2-988a87794de7","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-mGwrdZImihD3TTLl_QpVSMphtCEVz4p6vhDbkxgx56wZDLuj7ream4uS2sSH"}
{"level":"debug","ts":"2026-07-22T15:59:49Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d5706d0e-3448-45e7-9cc2-988a87794de7","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-290ac7.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-mGwrdZImihD3TTLl_QpVSMphtCEVz4p6vhDbkxgx56wZDLuj7ream4uS2sSH\"}"}
{"level":"debug","ts":"2026-07-22T15:59:49Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d5706d0e-3448-45e7-9cc2-988a87794de7","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-290ac7.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"dfa9a3e2-19c7-4a58-8c0a-23d857fe7d47","keyName":"e2e-rate-a-81c647","subscription":"e2e-rate-iso-a-81c647","tenant":"e2e-shared-a-290ac7","userId":"dfa9a3e2-19c7-4a58-8c0a-23d857fe7d47","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-22T15:59:49Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d5706d0e-3448-45e7-9cc2-988a87794de7","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-290ac7.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-290ac7/rate-test-model-290ac7\",\"requestedSubscription\":\"e2e-rate-iso-a-81c647\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-22T15:59:49Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d5706d0e-3448-45e7-9cc2-988a87794de7","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-290ac7.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-290ac7","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-81c647","namespace":"ai-tenant-e2e-shared-a-290ac7","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-290ac7/rate-test-model-290ac7"}}
{"level":"debug","ts":"2026-07-22T15:59:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d5706d0e-3448-45e7-9cc2-988a87794de7","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T15:59:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d5706d0e-3448-45e7-9cc2-988a87794de7","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T15:59:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d5706d0e-3448-45e7-9cc2-988a87794de7","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T15:59:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d5706d0e-3448-45e7-9cc2-988a87794de7","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-290ac7/rate-test-model-290ac7\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-290ac7/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T15:59:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d5706d0e-3448-45e7-9cc2-988a87794de7","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T15:59:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d5706d0e-3448-45e7-9cc2-988a87794de7","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T15:59:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d5706d0e-3448-45e7-9cc2-988a87794de7","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T15:59:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d5706d0e-3448-45e7-9cc2-988a87794de7","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-81c647"}
{"level":"debug","ts":"2026-07-22T15:59:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d5706d0e-3448-45e7-9cc2-988a87794de7","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"dfa9a3e2-19c7-4a58-8c0a-23d857fe7d47","keyName":"e2e-rate-a-81c647","selected_subscription":"e2e-rate-iso-a-81c647","selected_subscription_key":"ai-tenant-e2e-shared-a-290ac7/e2e-rate-iso-a-81c647@ai-tenant-e2e-shared-a-290ac7/rate-test-model-290ac7","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-290ac7","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-81c647","namespace":"ai-tenant-e2e-shared-a-290ac7","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-290ac7/rate-test-model-290ac7"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-22T15:59:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d5706d0e-3448-45e7-9cc2-988a87794de7","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T15:59:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d5706d0e-3448-45e7-9cc2-988a87794de7","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T15:59:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6ade7569-3924-4d1d-9ca1-af523a9e6910","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:38630","PortSpecifier":{"PortValue":38630}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6ade7569-3924-4d1d-9ca1-af523a9e6910","method":"POST","path":"/ai-tenant-e2e-shared-a-290ac7/rate-test-model-290ac7/v1/completions","host":"e2e-shared-a-290ac7.apps.8aeab84e-a5b3-4a0d-aed2-b31fdb35003a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T15:59:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6ade7569-3924-4d1d-9ca1-af523a9e6910","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:38630","PortSpecifier":{"PortValue":38630}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784735990,"nanos":899124909},"http":{"id":"6ade7569-3924-4d1d-9ca1-af523a9e6910","method":"POST","headers":{":authority":"e2e-shared-a-290ac7.apps.8aeab84e-a5b3-4a0d-aed2-b31fdb35003a.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-290ac7/rate-test-model-290ac7/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T15:59:50Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6ade7569-3924-4d1d-9ca1-af523a9e6910","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-mGwrdZImihD3TTLl_QpVSMphtCEVz4p6vhDbkxgx56wZDLuj7ream4uS2sSH"}
{"level":"debug","ts":"2026-07-22T15:59:50Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6ade7569-3924-4d1d-9ca1-af523a9e6910","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-290ac7.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-mGwrdZImihD3TTLl_QpVSMphtCEVz4p6vhDbkxgx56wZDLuj7ream4uS2sSH\"}"}
{"level":"debug","ts":"2026-07-22T15:59:50Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6ade7569-3924-4d1d-9ca1-af523a9e6910","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-290ac7.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"dfa9a3e2-19c7-4a58-8c0a-23d857fe7d47","keyName":"e2e-rate-a-81c647","subscription":"e2e-rate-iso-a-81c647","tenant":"e2e-shared-a-290ac7","userId":"dfa9a3e2-19c7-4a58-8c0a-23d857fe7d47","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-22T15:59:50Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6ade7569-3924-4d1d-9ca1-af523a9e6910","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-290ac7.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-290ac7/rate-test-model-290ac7\",\"requestedSubscription\":\"e2e-rate-iso-a-81c647\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-22T15:59:50Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6ade7569-3924-4d1d-9ca1-af523a9e6910","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-290ac7.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-290ac7","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-81c647","namespace":"ai-tenant-e2e-shared-a-290ac7","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-290ac7/rate-test-model-290ac7"}}
{"level":"debug","ts":"2026-07-22T15:59:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6ade7569-3924-4d1d-9ca1-af523a9e6910","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T15:59:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6ade7569-3924-4d1d-9ca1-af523a9e6910","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T15:59:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6ade7569-3924-4d1d-9ca1-af523a9e6910","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T15:59:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6ade7569-3924-4d1d-9ca1-af523a9e6910","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-290ac7/rate-test-model-290ac7\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-290ac7/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T15:59:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6ade7569-3924-4d1d-9ca1-af523a9e6910","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T15:59:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6ade7569-3924-4d1d-9ca1-af523a9e6910","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T15:59:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6ade7569-3924-4d1d-9ca1-af523a9e6910","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-81c647"}
{"level":"debug","ts":"2026-07-22T15:59:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6ade7569-3924-4d1d-9ca1-af523a9e6910","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T15:59:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6ade7569-3924-4d1d-9ca1-af523a9e6910","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"dfa9a3e2-19c7-4a58-8c0a-23d857fe7d47","keyName":"e2e-rate-a-81c647","selected_subscription":"e2e-rate-iso-a-81c647","selected_subscription_key":"ai-tenant-e2e-shared-a-290ac7/e2e-rate-iso-a-81c647@ai-tenant-e2e-shared-a-290ac7/rate-test-model-290ac7","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-290ac7","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-81c647","namespace":"ai-tenant-e2e-shared-a-290ac7","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-290ac7/rate-test-model-290ac7"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-22T15:59:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6ade7569-3924-4d1d-9ca1-af523a9e6910","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T15:59:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6ade7569-3924-4d1d-9ca1-af523a9e6910","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T15:59:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"87f7bfb7-c425-4b63-a233-e233c58cfe5c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:39494","PortSpecifier":{"PortValue":39494}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.65:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"87f7bfb7-c425-4b63-a233-e233c58cfe5c","method":"POST","path":"/ai-tenant-e2e-shared-b-9911b9/rate-test-model-9911b9/v1/completions","host":"e2e-shared-b-9911b9.apps.8aeab84e-a5b3-4a0d-aed2-b31fdb35003a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T15:59:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"87f7bfb7-c425-4b63-a233-e233c58cfe5c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:39494","PortSpecifier":{"PortValue":39494}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.65:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784735990,"nanos":935983292},"http":{"id":"87f7bfb7-c425-4b63-a233-e233c58cfe5c","method":"POST","headers":{":authority":"e2e-shared-b-9911b9.apps.8aeab84e-a5b3-4a0d-aed2-b31fdb35003a.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-9911b9/rate-test-model-9911b9/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T15:59:50Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"87f7bfb7-c425-4b63-a233-e233c58cfe5c","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1D8tuc2Q3FyYImnBk_n5gaYLA6qUcI0z3mbxibxWTZtnTaFW0dNdrROtfIzD8"}
{"level":"debug","ts":"2026-07-22T15:59:50Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"87f7bfb7-c425-4b63-a233-e233c58cfe5c","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-9911b9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1D8tuc2Q3FyYImnBk_n5gaYLA6qUcI0z3mbxibxWTZtnTaFW0dNdrROtfIzD8\"}"}
{"level":"debug","ts":"2026-07-22T15:59:50Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"87f7bfb7-c425-4b63-a233-e233c58cfe5c","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-9911b9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"5b2ad65b-1ff4-496a-b6db-08b337cc3add","keyName":"e2e-rate-b-81c647","subscription":"e2e-rate-iso-b-81c647","tenant":"e2e-shared-b-9911b9","userId":"5b2ad65b-1ff4-496a-b6db-08b337cc3add","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-22T15:59:50Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"87f7bfb7-c425-4b63-a233-e233c58cfe5c","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-9911b9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-9911b9/rate-test-model-9911b9\",\"requestedSubscription\":\"e2e-rate-iso-b-81c647\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-22T15:59:50Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"87f7bfb7-c425-4b63-a233-e233c58cfe5c","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-9911b9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-9911b9","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-81c647","namespace":"ai-tenant-e2e-shared-b-9911b9","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-b-9911b9/rate-test-model-9911b9"}}
{"level":"debug","ts":"2026-07-22T15:59:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"87f7bfb7-c425-4b63-a233-e233c58cfe5c","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T15:59:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"87f7bfb7-c425-4b63-a233-e233c58cfe5c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T15:59:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"87f7bfb7-c425-4b63-a233-e233c58cfe5c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T15:59:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"87f7bfb7-c425-4b63-a233-e233c58cfe5c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-9911b9/rate-test-model-9911b9\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-9911b9/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T15:59:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"87f7bfb7-c425-4b63-a233-e233c58cfe5c","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T15:59:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"87f7bfb7-c425-4b63-a233-e233c58cfe5c","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T15:59:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"87f7bfb7-c425-4b63-a233-e233c58cfe5c","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T15:59:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"87f7bfb7-c425-4b63-a233-e233c58cfe5c","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-81c647"}
{"level":"debug","ts":"2026-07-22T15:59:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"87f7bfb7-c425-4b63-a233-e233c58cfe5c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"5b2ad65b-1ff4-496a-b6db-08b337cc3add","keyName":"e2e-rate-b-81c647","selected_subscription":"e2e-rate-iso-b-81c647","selected_subscription_key":"ai-tenant-e2e-shared-b-9911b9/e2e-rate-iso-b-81c647@ai-tenant-e2e-shared-b-9911b9/rate-test-model-9911b9","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-9911b9","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-81c647","namespace":"ai-tenant-e2e-shared-b-9911b9","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-b-9911b9/rate-test-model-9911b9"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-22T15:59:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"87f7bfb7-c425-4b63-a233-e233c58cfe5c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T15:59:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"87f7bfb7-c425-4b63-a233-e233c58cfe5c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T15:59:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/359673a0742083c8f2eb301627aa2befd48230e53a04ddbb14cd674df40ecd99"}
{"level":"info","ts":"2026-07-22T15:59:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c2afa9b7e022783f4f938c2c5faae09335fe51fc4b88aabddd96e2cf4153be8e"}
{"level":"info","ts":"2026-07-22T15:59:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b16e429af6b757a853fc0e8280dafec3cb2ad1314f4fe0a6f8f90f25334e5622"}
{"level":"info","ts":"2026-07-22T15:59:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e7404e276456366ea8d79a6854f7eeed787fa95a0a2be2d86544354631c1d53a"}
{"level":"info","ts":"2026-07-22T15:59:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9a1e9faaf8d26796aa926f65c1998412ef835b4c8ef7f18b7c3f5657756e2ae3"}
{"level":"info","ts":"2026-07-22T15:59:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/10fbcf06e3e5fc96692f1a2503de5b90558867d274fdd5573a47e798f30ab447"}
{"level":"info","ts":"2026-07-22T15:59:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4bc156861a86161f0d9709c648f2d52dfba253577077af47aea91d9b7c8d547b"}
{"level":"info","ts":"2026-07-22T15:59:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d8a1f62c712760aa8f013be89ade3264538c41f3a17763d88c503184c87d3481"}
{"level":"info","ts":"2026-07-22T15:59:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6e75b1e8c62669a4e030b5c130a761e8ab452edb76155e1b661b410b2e99310b"}
{"level":"info","ts":"2026-07-22T15:59:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d41faccd59d1ecdf40a6bebd7377bb6a6fe285547f635ed8f2c9a7dfb0c02536"}
{"level":"info","ts":"2026-07-22T15:59:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/bed2e654ee47a83fa34b2ea40e6902af2d1badc015ea53fa26e1dfd01bc385d3"}
{"level":"info","ts":"2026-07-22T15:59:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ee8179371a21afffe2be8eaceb423d719a70f7a3649bf63d8cd2d4f36c3fa52e"}
{"level":"info","ts":"2026-07-22T15:59:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/dcfa377d07ee6bf7e9a665a7edbc233097e6aa5944d0a3983e586df2089d63fe"}
{"level":"info","ts":"2026-07-22T15:59:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/17de2adb6d944260e5a672a3d74f0089a50aa165ffcd2955e7e4735b79812085"}
{"level":"info","ts":"2026-07-22T15:59:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e03fdd5a143a240868123824a24fb7bba9fd12ff84695e5b17caf838dce55d36"}
{"level":"info","ts":"2026-07-22T15:59:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3b29e83740468d7476d23855c4a2c18a8ac90c3582a4c99c0b4c5ef3dfcaa1c9"}
{"level":"info","ts":"2026-07-22T15:59:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b1c2c74e444dc331d815131025fc40288fa1c0a4f3b09337f84938306abeb057"}
{"level":"info","ts":"2026-07-22T15:59:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9895548f95df31cd9bab5baf2b2429fae34fc49b852532778cba13ac39b589e3"}
{"level":"info","ts":"2026-07-22T15:59:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ec1cd086346e07db13894efba57b4a3c91e5e1b6f7625cdb0c5a31b0fcca364f"}
{"level":"info","ts":"2026-07-22T15:59:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/044dbbfc6a750b7895d85d101c22119670dc45a4d1ec66f772cccffa22914c29"}
{"level":"info","ts":"2026-07-22T15:59:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3bfcb9078bfab1746d665389fb137bc0788f34a8d0047daab300174662ebf48b"}
{"level":"info","ts":"2026-07-22T15:59:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ed95769c2bca54eb95d56ead8f12a2a65f5d96e659aff008cc4226e028b9af75"}
{"level":"info","ts":"2026-07-22T15:59:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/559864ad3941b79ccd52fb2dadd5b2fdd0f4290bec91470ec91c5a715996cddb"}
{"level":"info","ts":"2026-07-22T15:59:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/13c6160e8a2a7deff4fa2512060074fd99cc20b78be9cb988f9ac6c37068d7f4"}