{"level":"info","ts":"2026-07-24T15:16:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"894852862e694c1a8cc4de376deb5063c657089f3fdc0afc53c0b9e92dceaa71","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T15:16:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"55a5d4ab21bb36f7f40978ce640f1e48428a71b01d8a07eff1fd4260ceb86991","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T15:16:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"499f7bb1c8dda74259ca646913acc34b1ef2a1884926d433d10d853def921b85","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T15:16:41Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T15:16:41Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["499f7bb1c8dda74259ca646913acc34b1ef2a1884926d433d10d853def921b85"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T15:16:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/894852862e694c1a8cc4de376deb5063c657089f3fdc0afc53c0b9e92dceaa71"}
{"level":"info","ts":"2026-07-24T15:16:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"499f7bb1c8dda74259ca646913acc34b1ef2a1884926d433d10d853def921b85","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T15:16:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"759b45c05cdd6b3edf3f3c5ea6df90383879f1ba2513a2429afd462c751a1355","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T15:16:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a54aceada7cfcc76c05c9ba322b82d92df7e27cbbf943a766117a7127d669fc6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T15:16:41Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T15:16:41Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a54aceada7cfcc76c05c9ba322b82d92df7e27cbbf943a766117a7127d669fc6"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T15:16:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/499f7bb1c8dda74259ca646913acc34b1ef2a1884926d433d10d853def921b85"}
{"level":"info","ts":"2026-07-24T15:16:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a54aceada7cfcc76c05c9ba322b82d92df7e27cbbf943a766117a7127d669fc6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T15:16:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"016c0ddecb4c0887d62fd7497af33190e4653b22059f94f127356f0738724b32","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T15:16:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b6afbb0129bf35ade2dff4570abfcc0353e3fe180f9f0c71ad102c06b223653d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T15:16:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7b1ef7cbc9f4bd6212c3657be9cf2e8359d760550e0722cee4ced1d55b2cb2d4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T15:16:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"83c8196c690585df78e9d0a89dac8af76b3ba3959ca1d0d967e78a6c34efdd52","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T15:16:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e43a58d97b85af61310417750a457e79000576dc5901f098b80a99b396ddac3e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T15:16:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cac0d1ed8c9ebc34639a723d1de883cd26d05c7a3fb8fe0f74efda5642dff75a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T15:16:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"894852862e694c1a8cc4de376deb5063c657089f3fdc0afc53c0b9e92dceaa71","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T15:16:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"499f7bb1c8dda74259ca646913acc34b1ef2a1884926d433d10d853def921b85","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T15:16:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a54aceada7cfcc76c05c9ba322b82d92df7e27cbbf943a766117a7127d669fc6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T15:16:41Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T15:16:41Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T15:16:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a54aceada7cfcc76c05c9ba322b82d92df7e27cbbf943a766117a7127d669fc6"}
{"level":"info","ts":"2026-07-24T15:16:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a54aceada7cfcc76c05c9ba322b82d92df7e27cbbf943a766117a7127d669fc6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T15:16:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a54aceada7cfcc76c05c9ba322b82d92df7e27cbbf943a766117a7127d669fc6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T15:16:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a54aceada7cfcc76c05c9ba322b82d92df7e27cbbf943a766117a7127d669fc6","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T15:16:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a54aceada7cfcc76c05c9ba322b82d92df7e27cbbf943a766117a7127d669fc6"}
{"level":"debug","ts":"2026-07-24T15:16:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a54aceada7cfcc76c05c9ba322b82d92df7e27cbbf943a766117a7127d669fc6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T15:16:41Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T15:16:41Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a54aceada7cfcc76c05c9ba322b82d92df7e27cbbf943a766117a7127d669fc6"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T15:16:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a54aceada7cfcc76c05c9ba322b82d92df7e27cbbf943a766117a7127d669fc6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T15:16:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a54aceada7cfcc76c05c9ba322b82d92df7e27cbbf943a766117a7127d669fc6","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T15:16:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a54aceada7cfcc76c05c9ba322b82d92df7e27cbbf943a766117a7127d669fc6"}
{"level":"info","ts":"2026-07-24T15:16:48Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"165b9df7-92dd-4c34-8f0c-16577fd4b7d7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:36560","PortSpecifier":{"PortValue":36560}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.73:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"165b9df7-92dd-4c34-8f0c-16577fd4b7d7","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-dc7d81.apps.3be3295e-9019-4b6b-9df8-99ce19d48613.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T15:16:48Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"165b9df7-92dd-4c34-8f0c-16577fd4b7d7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:36560","PortSpecifier":{"PortValue":36560}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.73:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784906208,"nanos":624992551},"http":{"id":"165b9df7-92dd-4c34-8f0c-16577fd4b7d7","method":"POST","headers":{":authority":"e2e-shared-a-dc7d81.apps.3be3295e-9019-4b6b-9df8-99ce19d48613.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T15:16:48Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"165b9df7-92dd-4c34-8f0c-16577fd4b7d7","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-24T15:16:48Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"165b9df7-92dd-4c34-8f0c-16577fd4b7d7","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"e9103260-9a05-4d99-8fa1-24683f35cf9c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=ac7166a7-f0ef-4ddf-98c5-a70fe2accb13"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/99ce19d48613"]}}
{"level":"debug","ts":"2026-07-24T15:16:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"165b9df7-92dd-4c34-8f0c-16577fd4b7d7","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/99ce19d48613"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=ac7166a7-f0ef-4ddf-98c5-a70fe2accb13"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"e9103260-9a05-4d99-8fa1-24683f35cf9c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"09bae11e466c1b7fd4a4390697823bdeb809c77799dcbe3c253ff8186111edd5"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.73:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-dc7d81.apps.3be3295e-9019-4b6b-9df8-99ce19d48613.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T15:16:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"165b9df7-92dd-4c34-8f0c-16577fd4b7d7","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T15:16:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"165b9df7-92dd-4c34-8f0c-16577fd4b7d7","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T15:16:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"165b9df7-92dd-4c34-8f0c-16577fd4b7d7","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-dc7d81/rate-test-model-dc7d81\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-dc7d81/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T15:16:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"165b9df7-92dd-4c34-8f0c-16577fd4b7d7","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-24T15:16:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"165b9df7-92dd-4c34-8f0c-16577fd4b7d7","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T15:16:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"165b9df7-92dd-4c34-8f0c-16577fd4b7d7","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-24T15:16:48Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"165b9df7-92dd-4c34-8f0c-16577fd4b7d7","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T15:16:48Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"165b9df7-92dd-4c34-8f0c-16577fd4b7d7","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T15:16:48Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"775b332b-eb0d-4ef6-ad24-dd8aa48430e7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:38844","PortSpecifier":{"PortValue":38844}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.76:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"775b332b-eb0d-4ef6-ad24-dd8aa48430e7","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-8ea489.apps.3be3295e-9019-4b6b-9df8-99ce19d48613.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T15:16:48Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"775b332b-eb0d-4ef6-ad24-dd8aa48430e7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:38844","PortSpecifier":{"PortValue":38844}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.76:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784906208,"nanos":671209888},"http":{"id":"775b332b-eb0d-4ef6-ad24-dd8aa48430e7","method":"POST","headers":{":authority":"e2e-shared-b-8ea489.apps.3be3295e-9019-4b6b-9df8-99ce19d48613.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T15:16:48Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"775b332b-eb0d-4ef6-ad24-dd8aa48430e7","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-24T15:16:48Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"775b332b-eb0d-4ef6-ad24-dd8aa48430e7","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"e9103260-9a05-4d99-8fa1-24683f35cf9c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=ac7166a7-f0ef-4ddf-98c5-a70fe2accb13"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/99ce19d48613"]}}
{"level":"debug","ts":"2026-07-24T15:16:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"775b332b-eb0d-4ef6-ad24-dd8aa48430e7","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/99ce19d48613"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=ac7166a7-f0ef-4ddf-98c5-a70fe2accb13"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"e9103260-9a05-4d99-8fa1-24683f35cf9c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"3c418244c8795aafcaa38df340a22943da5e6dc77f4f8c2d142afad2a76c0fc8"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.76:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-8ea489.apps.3be3295e-9019-4b6b-9df8-99ce19d48613.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T15:16:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"775b332b-eb0d-4ef6-ad24-dd8aa48430e7","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T15:16:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"775b332b-eb0d-4ef6-ad24-dd8aa48430e7","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T15:16:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"775b332b-eb0d-4ef6-ad24-dd8aa48430e7","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-8ea489/rate-test-model-8ea489\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-8ea489/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T15:16:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"775b332b-eb0d-4ef6-ad24-dd8aa48430e7","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-24T15:16:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"775b332b-eb0d-4ef6-ad24-dd8aa48430e7","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T15:16:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"775b332b-eb0d-4ef6-ad24-dd8aa48430e7","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-24T15:16:48Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"775b332b-eb0d-4ef6-ad24-dd8aa48430e7","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T15:16:48Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"775b332b-eb0d-4ef6-ad24-dd8aa48430e7","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T15:16:48Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"91ec5fff-3d26-4386-94ff-42e36b8f721d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:36562","PortSpecifier":{"PortValue":36562}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.73:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"91ec5fff-3d26-4386-94ff-42e36b8f721d","method":"POST","path":"/ai-tenant-e2e-shared-a-dc7d81/rate-test-model-dc7d81/v1/completions","host":"e2e-shared-a-dc7d81.apps.3be3295e-9019-4b6b-9df8-99ce19d48613.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T15:16:48Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"91ec5fff-3d26-4386-94ff-42e36b8f721d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:36562","PortSpecifier":{"PortValue":36562}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.73:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784906208,"nanos":714331359},"http":{"id":"91ec5fff-3d26-4386-94ff-42e36b8f721d","method":"POST","headers":{":authority":"e2e-shared-a-dc7d81.apps.3be3295e-9019-4b6b-9df8-99ce19d48613.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-dc7d81/rate-test-model-dc7d81/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T15:16:48Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"91ec5fff-3d26-4386-94ff-42e36b8f721d","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U6IJiYeP84Xrgwqk_3OFVJkKnTwMQEQgrTkHHUjDSMbagnFFpmdCITc1iznH"}
{"level":"debug","ts":"2026-07-24T15:16:48Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"91ec5fff-3d26-4386-94ff-42e36b8f721d","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-dc7d81.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U6IJiYeP84Xrgwqk_3OFVJkKnTwMQEQgrTkHHUjDSMbagnFFpmdCITc1iznH\"}"}
{"level":"debug","ts":"2026-07-24T15:16:48Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"91ec5fff-3d26-4386-94ff-42e36b8f721d","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-dc7d81.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"63f996f2-e5cd-48b2-95d7-52ed009cac61","keyName":"e2e-rate-a-03df77","subscription":"e2e-rate-iso-a-03df77","tenant":"e2e-shared-a-dc7d81","userId":"63f996f2-e5cd-48b2-95d7-52ed009cac61","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T15:16:48Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"91ec5fff-3d26-4386-94ff-42e36b8f721d","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-dc7d81.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-dc7d81/rate-test-model-dc7d81\",\"requestedSubscription\":\"e2e-rate-iso-a-03df77\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T15:16:48Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"91ec5fff-3d26-4386-94ff-42e36b8f721d","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-dc7d81.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-dc7d81","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-03df77","namespace":"ai-tenant-e2e-shared-a-dc7d81","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-dc7d81/rate-test-model-dc7d81"}}
{"level":"debug","ts":"2026-07-24T15:16:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"91ec5fff-3d26-4386-94ff-42e36b8f721d","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T15:16:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"91ec5fff-3d26-4386-94ff-42e36b8f721d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T15:16:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"91ec5fff-3d26-4386-94ff-42e36b8f721d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T15:16:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"91ec5fff-3d26-4386-94ff-42e36b8f721d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-dc7d81/rate-test-model-dc7d81\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-dc7d81/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T15:16:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"91ec5fff-3d26-4386-94ff-42e36b8f721d","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T15:16:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"91ec5fff-3d26-4386-94ff-42e36b8f721d","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T15:16:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"91ec5fff-3d26-4386-94ff-42e36b8f721d","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T15:16:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"91ec5fff-3d26-4386-94ff-42e36b8f721d","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-03df77"}
{"level":"debug","ts":"2026-07-24T15:16:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"91ec5fff-3d26-4386-94ff-42e36b8f721d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"63f996f2-e5cd-48b2-95d7-52ed009cac61","keyName":"e2e-rate-a-03df77","selected_subscription":"e2e-rate-iso-a-03df77","selected_subscription_key":"ai-tenant-e2e-shared-a-dc7d81/e2e-rate-iso-a-03df77@ai-tenant-e2e-shared-a-dc7d81/rate-test-model-dc7d81","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-dc7d81","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-03df77","namespace":"ai-tenant-e2e-shared-a-dc7d81","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-dc7d81/rate-test-model-dc7d81"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T15:16:48Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"91ec5fff-3d26-4386-94ff-42e36b8f721d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T15:16:48Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"91ec5fff-3d26-4386-94ff-42e36b8f721d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T15:16:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"02c5a0fe-16c6-472f-9dd4-263a0cf2462e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:36578","PortSpecifier":{"PortValue":36578}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.73:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"02c5a0fe-16c6-472f-9dd4-263a0cf2462e","method":"POST","path":"/ai-tenant-e2e-shared-a-dc7d81/rate-test-model-dc7d81/v1/completions","host":"e2e-shared-a-dc7d81.apps.3be3295e-9019-4b6b-9df8-99ce19d48613.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T15:16:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"02c5a0fe-16c6-472f-9dd4-263a0cf2462e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:36578","PortSpecifier":{"PortValue":36578}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.73:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784906209,"nanos":806440070},"http":{"id":"02c5a0fe-16c6-472f-9dd4-263a0cf2462e","method":"POST","headers":{":authority":"e2e-shared-a-dc7d81.apps.3be3295e-9019-4b6b-9df8-99ce19d48613.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-dc7d81/rate-test-model-dc7d81/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T15:16:49Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"02c5a0fe-16c6-472f-9dd4-263a0cf2462e","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U6IJiYeP84Xrgwqk_3OFVJkKnTwMQEQgrTkHHUjDSMbagnFFpmdCITc1iznH"}
{"level":"debug","ts":"2026-07-24T15:16:49Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"02c5a0fe-16c6-472f-9dd4-263a0cf2462e","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-dc7d81.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U6IJiYeP84Xrgwqk_3OFVJkKnTwMQEQgrTkHHUjDSMbagnFFpmdCITc1iznH\"}"}
{"level":"debug","ts":"2026-07-24T15:16:49Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"02c5a0fe-16c6-472f-9dd4-263a0cf2462e","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-dc7d81.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"63f996f2-e5cd-48b2-95d7-52ed009cac61","keyName":"e2e-rate-a-03df77","subscription":"e2e-rate-iso-a-03df77","tenant":"e2e-shared-a-dc7d81","userId":"63f996f2-e5cd-48b2-95d7-52ed009cac61","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T15:16:49Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"02c5a0fe-16c6-472f-9dd4-263a0cf2462e","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-dc7d81.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-dc7d81/rate-test-model-dc7d81\",\"requestedSubscription\":\"e2e-rate-iso-a-03df77\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T15:16:49Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"02c5a0fe-16c6-472f-9dd4-263a0cf2462e","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-dc7d81.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-dc7d81","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-03df77","namespace":"ai-tenant-e2e-shared-a-dc7d81","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-dc7d81/rate-test-model-dc7d81"}}
{"level":"debug","ts":"2026-07-24T15:16:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"02c5a0fe-16c6-472f-9dd4-263a0cf2462e","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T15:16:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"02c5a0fe-16c6-472f-9dd4-263a0cf2462e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T15:16:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"02c5a0fe-16c6-472f-9dd4-263a0cf2462e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T15:16:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"02c5a0fe-16c6-472f-9dd4-263a0cf2462e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-dc7d81/rate-test-model-dc7d81\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-dc7d81/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T15:16:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"02c5a0fe-16c6-472f-9dd4-263a0cf2462e","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T15:16:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"02c5a0fe-16c6-472f-9dd4-263a0cf2462e","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T15:16:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"02c5a0fe-16c6-472f-9dd4-263a0cf2462e","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-03df77"}
{"level":"debug","ts":"2026-07-24T15:16:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"02c5a0fe-16c6-472f-9dd4-263a0cf2462e","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T15:16:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"02c5a0fe-16c6-472f-9dd4-263a0cf2462e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"63f996f2-e5cd-48b2-95d7-52ed009cac61","keyName":"e2e-rate-a-03df77","selected_subscription":"e2e-rate-iso-a-03df77","selected_subscription_key":"ai-tenant-e2e-shared-a-dc7d81/e2e-rate-iso-a-03df77@ai-tenant-e2e-shared-a-dc7d81/rate-test-model-dc7d81","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-dc7d81","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-03df77","namespace":"ai-tenant-e2e-shared-a-dc7d81","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-dc7d81/rate-test-model-dc7d81"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T15:16:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"02c5a0fe-16c6-472f-9dd4-263a0cf2462e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T15:16:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"02c5a0fe-16c6-472f-9dd4-263a0cf2462e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T15:16:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"bb2b4663-73a3-4d53-a8bd-ea68add441bb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:36588","PortSpecifier":{"PortValue":36588}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.73:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"bb2b4663-73a3-4d53-a8bd-ea68add441bb","method":"POST","path":"/ai-tenant-e2e-shared-a-dc7d81/rate-test-model-dc7d81/v1/completions","host":"e2e-shared-a-dc7d81.apps.3be3295e-9019-4b6b-9df8-99ce19d48613.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T15:16:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"bb2b4663-73a3-4d53-a8bd-ea68add441bb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:36588","PortSpecifier":{"PortValue":36588}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.73:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784906210,"nanos":850735012},"http":{"id":"bb2b4663-73a3-4d53-a8bd-ea68add441bb","method":"POST","headers":{":authority":"e2e-shared-a-dc7d81.apps.3be3295e-9019-4b6b-9df8-99ce19d48613.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-dc7d81/rate-test-model-dc7d81/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T15:16:50Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"bb2b4663-73a3-4d53-a8bd-ea68add441bb","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U6IJiYeP84Xrgwqk_3OFVJkKnTwMQEQgrTkHHUjDSMbagnFFpmdCITc1iznH"}
{"level":"debug","ts":"2026-07-24T15:16:50Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"bb2b4663-73a3-4d53-a8bd-ea68add441bb","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-dc7d81.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U6IJiYeP84Xrgwqk_3OFVJkKnTwMQEQgrTkHHUjDSMbagnFFpmdCITc1iznH\"}"}
{"level":"debug","ts":"2026-07-24T15:16:50Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"bb2b4663-73a3-4d53-a8bd-ea68add441bb","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-dc7d81.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"63f996f2-e5cd-48b2-95d7-52ed009cac61","keyName":"e2e-rate-a-03df77","subscription":"e2e-rate-iso-a-03df77","tenant":"e2e-shared-a-dc7d81","userId":"63f996f2-e5cd-48b2-95d7-52ed009cac61","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T15:16:50Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"bb2b4663-73a3-4d53-a8bd-ea68add441bb","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-dc7d81.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-dc7d81/rate-test-model-dc7d81\",\"requestedSubscription\":\"e2e-rate-iso-a-03df77\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T15:16:50Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"bb2b4663-73a3-4d53-a8bd-ea68add441bb","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-dc7d81.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-dc7d81","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-03df77","namespace":"ai-tenant-e2e-shared-a-dc7d81","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-dc7d81/rate-test-model-dc7d81"}}
{"level":"debug","ts":"2026-07-24T15:16:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"bb2b4663-73a3-4d53-a8bd-ea68add441bb","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T15:16:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bb2b4663-73a3-4d53-a8bd-ea68add441bb","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T15:16:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bb2b4663-73a3-4d53-a8bd-ea68add441bb","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T15:16:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bb2b4663-73a3-4d53-a8bd-ea68add441bb","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-dc7d81/rate-test-model-dc7d81\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-dc7d81/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T15:16:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bb2b4663-73a3-4d53-a8bd-ea68add441bb","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T15:16:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bb2b4663-73a3-4d53-a8bd-ea68add441bb","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T15:16:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bb2b4663-73a3-4d53-a8bd-ea68add441bb","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T15:16:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bb2b4663-73a3-4d53-a8bd-ea68add441bb","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-03df77"}
{"level":"debug","ts":"2026-07-24T15:16:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bb2b4663-73a3-4d53-a8bd-ea68add441bb","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"63f996f2-e5cd-48b2-95d7-52ed009cac61","keyName":"e2e-rate-a-03df77","selected_subscription":"e2e-rate-iso-a-03df77","selected_subscription_key":"ai-tenant-e2e-shared-a-dc7d81/e2e-rate-iso-a-03df77@ai-tenant-e2e-shared-a-dc7d81/rate-test-model-dc7d81","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-dc7d81","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-03df77","namespace":"ai-tenant-e2e-shared-a-dc7d81","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-dc7d81/rate-test-model-dc7d81"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T15:16:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"bb2b4663-73a3-4d53-a8bd-ea68add441bb","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T15:16:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"bb2b4663-73a3-4d53-a8bd-ea68add441bb","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T15:17:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fb047b50-ad46-4567-9925-f4281a32adfe","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:53112","PortSpecifier":{"PortValue":53112}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.73:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"fb047b50-ad46-4567-9925-f4281a32adfe","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-dc7d81.apps.3be3295e-9019-4b6b-9df8-99ce19d48613.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T15:17:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fb047b50-ad46-4567-9925-f4281a32adfe","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:53112","PortSpecifier":{"PortValue":53112}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.73:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784906230,"nanos":319089851},"http":{"id":"fb047b50-ad46-4567-9925-f4281a32adfe","method":"POST","headers":{":authority":"e2e-shared-a-dc7d81.apps.3be3295e-9019-4b6b-9df8-99ce19d48613.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T15:17:10Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"fb047b50-ad46-4567-9925-f4281a32adfe","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-24T15:17:10Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"fb047b50-ad46-4567-9925-f4281a32adfe","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"e9103260-9a05-4d99-8fa1-24683f35cf9c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=ac7166a7-f0ef-4ddf-98c5-a70fe2accb13"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/99ce19d48613"]}}
{"level":"debug","ts":"2026-07-24T15:17:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"fb047b50-ad46-4567-9925-f4281a32adfe","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/99ce19d48613"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=ac7166a7-f0ef-4ddf-98c5-a70fe2accb13"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"e9103260-9a05-4d99-8fa1-24683f35cf9c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"09bae11e466c1b7fd4a4390697823bdeb809c77799dcbe3c253ff8186111edd5"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.73:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-dc7d81.apps.3be3295e-9019-4b6b-9df8-99ce19d48613.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T15:17:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fb047b50-ad46-4567-9925-f4281a32adfe","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T15:17:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fb047b50-ad46-4567-9925-f4281a32adfe","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T15:17:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fb047b50-ad46-4567-9925-f4281a32adfe","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-dc7d81/rate-test-model-dc7d81\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-dc7d81/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T15:17:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"fb047b50-ad46-4567-9925-f4281a32adfe","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-24T15:17:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fb047b50-ad46-4567-9925-f4281a32adfe","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T15:17:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fb047b50-ad46-4567-9925-f4281a32adfe","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-24T15:17:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fb047b50-ad46-4567-9925-f4281a32adfe","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T15:17:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fb047b50-ad46-4567-9925-f4281a32adfe","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T15:17:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8d94b742-13ff-4bb2-9d28-223b90616114","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:37496","PortSpecifier":{"PortValue":37496}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.76:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"8d94b742-13ff-4bb2-9d28-223b90616114","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-8ea489.apps.3be3295e-9019-4b6b-9df8-99ce19d48613.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T15:17:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8d94b742-13ff-4bb2-9d28-223b90616114","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:37496","PortSpecifier":{"PortValue":37496}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.76:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784906230,"nanos":364256409},"http":{"id":"8d94b742-13ff-4bb2-9d28-223b90616114","method":"POST","headers":{":authority":"e2e-shared-b-8ea489.apps.3be3295e-9019-4b6b-9df8-99ce19d48613.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T15:17:10Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"8d94b742-13ff-4bb2-9d28-223b90616114","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-24T15:17:10Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"8d94b742-13ff-4bb2-9d28-223b90616114","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"e9103260-9a05-4d99-8fa1-24683f35cf9c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=ac7166a7-f0ef-4ddf-98c5-a70fe2accb13"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/99ce19d48613"]}}
{"level":"debug","ts":"2026-07-24T15:17:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"8d94b742-13ff-4bb2-9d28-223b90616114","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/99ce19d48613"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=ac7166a7-f0ef-4ddf-98c5-a70fe2accb13"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"e9103260-9a05-4d99-8fa1-24683f35cf9c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"3c418244c8795aafcaa38df340a22943da5e6dc77f4f8c2d142afad2a76c0fc8"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.76:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-8ea489.apps.3be3295e-9019-4b6b-9df8-99ce19d48613.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T15:17:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8d94b742-13ff-4bb2-9d28-223b90616114","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T15:17:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8d94b742-13ff-4bb2-9d28-223b90616114","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T15:17:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8d94b742-13ff-4bb2-9d28-223b90616114","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-8ea489/rate-test-model-8ea489\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-8ea489/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T15:17:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"8d94b742-13ff-4bb2-9d28-223b90616114","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-24T15:17:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8d94b742-13ff-4bb2-9d28-223b90616114","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T15:17:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8d94b742-13ff-4bb2-9d28-223b90616114","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-24T15:17:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8d94b742-13ff-4bb2-9d28-223b90616114","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T15:17:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8d94b742-13ff-4bb2-9d28-223b90616114","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T15:17:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"408f408d-86ba-48d9-8622-a2b07a601568","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:53118","PortSpecifier":{"PortValue":53118}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.73:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"408f408d-86ba-48d9-8622-a2b07a601568","method":"POST","path":"/ai-tenant-e2e-shared-a-dc7d81/rate-test-model-dc7d81/v1/completions","host":"e2e-shared-a-dc7d81.apps.3be3295e-9019-4b6b-9df8-99ce19d48613.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T15:17:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"408f408d-86ba-48d9-8622-a2b07a601568","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:53118","PortSpecifier":{"PortValue":53118}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.73:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784906230,"nanos":402983958},"http":{"id":"408f408d-86ba-48d9-8622-a2b07a601568","method":"POST","headers":{":authority":"e2e-shared-a-dc7d81.apps.3be3295e-9019-4b6b-9df8-99ce19d48613.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-dc7d81/rate-test-model-dc7d81/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T15:17:10Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"408f408d-86ba-48d9-8622-a2b07a601568","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-5uXqxsAHnCoOF9Nu_dkB8pv09a8rFLpKClmZk8BqyVTXIFzzoVCoQXEQxZGr"}
{"level":"debug","ts":"2026-07-24T15:17:10Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"408f408d-86ba-48d9-8622-a2b07a601568","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-dc7d81.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-5uXqxsAHnCoOF9Nu_dkB8pv09a8rFLpKClmZk8BqyVTXIFzzoVCoQXEQxZGr\"}"}
{"level":"debug","ts":"2026-07-24T15:17:10Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"408f408d-86ba-48d9-8622-a2b07a601568","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-dc7d81.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"7c331479-a25c-4399-8e05-cf34ddeed09a","keyName":"e2e-rate-a-329362","subscription":"e2e-rate-iso-a-329362","tenant":"e2e-shared-a-dc7d81","userId":"7c331479-a25c-4399-8e05-cf34ddeed09a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T15:17:10Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"408f408d-86ba-48d9-8622-a2b07a601568","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-dc7d81.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-dc7d81/rate-test-model-dc7d81\",\"requestedSubscription\":\"e2e-rate-iso-a-329362\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T15:17:10Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"408f408d-86ba-48d9-8622-a2b07a601568","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-dc7d81.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-dc7d81","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-329362","namespace":"ai-tenant-e2e-shared-a-dc7d81","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-dc7d81/rate-test-model-dc7d81"}}
{"level":"debug","ts":"2026-07-24T15:17:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"408f408d-86ba-48d9-8622-a2b07a601568","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T15:17:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"408f408d-86ba-48d9-8622-a2b07a601568","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T15:17:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"408f408d-86ba-48d9-8622-a2b07a601568","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T15:17:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"408f408d-86ba-48d9-8622-a2b07a601568","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-dc7d81/rate-test-model-dc7d81\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-dc7d81/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T15:17:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"408f408d-86ba-48d9-8622-a2b07a601568","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T15:17:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"408f408d-86ba-48d9-8622-a2b07a601568","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-329362"}
{"level":"debug","ts":"2026-07-24T15:17:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"408f408d-86ba-48d9-8622-a2b07a601568","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T15:17:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"408f408d-86ba-48d9-8622-a2b07a601568","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T15:17:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"408f408d-86ba-48d9-8622-a2b07a601568","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"7c331479-a25c-4399-8e05-cf34ddeed09a","keyName":"e2e-rate-a-329362","selected_subscription":"e2e-rate-iso-a-329362","selected_subscription_key":"ai-tenant-e2e-shared-a-dc7d81/e2e-rate-iso-a-329362@ai-tenant-e2e-shared-a-dc7d81/rate-test-model-dc7d81","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-dc7d81","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-329362","namespace":"ai-tenant-e2e-shared-a-dc7d81","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-dc7d81/rate-test-model-dc7d81"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T15:17:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"408f408d-86ba-48d9-8622-a2b07a601568","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T15:17:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"408f408d-86ba-48d9-8622-a2b07a601568","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T15:17:11Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f12f9c87-a945-456a-9165-09c207e4adc6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:53132","PortSpecifier":{"PortValue":53132}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.73:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f12f9c87-a945-456a-9165-09c207e4adc6","method":"POST","path":"/ai-tenant-e2e-shared-a-dc7d81/rate-test-model-dc7d81/v1/completions","host":"e2e-shared-a-dc7d81.apps.3be3295e-9019-4b6b-9df8-99ce19d48613.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T15:17:11Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f12f9c87-a945-456a-9165-09c207e4adc6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:53132","PortSpecifier":{"PortValue":53132}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.73:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784906231,"nanos":444972756},"http":{"id":"f12f9c87-a945-456a-9165-09c207e4adc6","method":"POST","headers":{":authority":"e2e-shared-a-dc7d81.apps.3be3295e-9019-4b6b-9df8-99ce19d48613.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-dc7d81/rate-test-model-dc7d81/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T15:17:11Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f12f9c87-a945-456a-9165-09c207e4adc6","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-5uXqxsAHnCoOF9Nu_dkB8pv09a8rFLpKClmZk8BqyVTXIFzzoVCoQXEQxZGr"}
{"level":"debug","ts":"2026-07-24T15:17:11Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f12f9c87-a945-456a-9165-09c207e4adc6","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-dc7d81.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-5uXqxsAHnCoOF9Nu_dkB8pv09a8rFLpKClmZk8BqyVTXIFzzoVCoQXEQxZGr\"}"}
{"level":"debug","ts":"2026-07-24T15:17:11Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f12f9c87-a945-456a-9165-09c207e4adc6","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-dc7d81.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"7c331479-a25c-4399-8e05-cf34ddeed09a","keyName":"e2e-rate-a-329362","subscription":"e2e-rate-iso-a-329362","tenant":"e2e-shared-a-dc7d81","userId":"7c331479-a25c-4399-8e05-cf34ddeed09a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T15:17:11Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f12f9c87-a945-456a-9165-09c207e4adc6","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-dc7d81.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-dc7d81/rate-test-model-dc7d81\",\"requestedSubscription\":\"e2e-rate-iso-a-329362\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T15:17:11Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f12f9c87-a945-456a-9165-09c207e4adc6","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-dc7d81.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-dc7d81","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-329362","namespace":"ai-tenant-e2e-shared-a-dc7d81","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-dc7d81/rate-test-model-dc7d81"}}
{"level":"debug","ts":"2026-07-24T15:17:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f12f9c87-a945-456a-9165-09c207e4adc6","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T15:17:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f12f9c87-a945-456a-9165-09c207e4adc6","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T15:17:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f12f9c87-a945-456a-9165-09c207e4adc6","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T15:17:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f12f9c87-a945-456a-9165-09c207e4adc6","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-dc7d81/rate-test-model-dc7d81\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-dc7d81/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T15:17:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f12f9c87-a945-456a-9165-09c207e4adc6","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T15:17:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f12f9c87-a945-456a-9165-09c207e4adc6","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-329362"}
{"level":"debug","ts":"2026-07-24T15:17:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f12f9c87-a945-456a-9165-09c207e4adc6","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T15:17:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f12f9c87-a945-456a-9165-09c207e4adc6","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T15:17:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f12f9c87-a945-456a-9165-09c207e4adc6","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"7c331479-a25c-4399-8e05-cf34ddeed09a","keyName":"e2e-rate-a-329362","selected_subscription":"e2e-rate-iso-a-329362","selected_subscription_key":"ai-tenant-e2e-shared-a-dc7d81/e2e-rate-iso-a-329362@ai-tenant-e2e-shared-a-dc7d81/rate-test-model-dc7d81","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-dc7d81","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-329362","namespace":"ai-tenant-e2e-shared-a-dc7d81","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-dc7d81/rate-test-model-dc7d81"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T15:17:11Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f12f9c87-a945-456a-9165-09c207e4adc6","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T15:17:11Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f12f9c87-a945-456a-9165-09c207e4adc6","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T15:17:12Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b43d4ea7-0b15-46f3-8728-7e393a4ea3e2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:53136","PortSpecifier":{"PortValue":53136}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.73:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b43d4ea7-0b15-46f3-8728-7e393a4ea3e2","method":"POST","path":"/ai-tenant-e2e-shared-a-dc7d81/rate-test-model-dc7d81/v1/completions","host":"e2e-shared-a-dc7d81.apps.3be3295e-9019-4b6b-9df8-99ce19d48613.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T15:17:12Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b43d4ea7-0b15-46f3-8728-7e393a4ea3e2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:53136","PortSpecifier":{"PortValue":53136}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.73:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784906232,"nanos":483810057},"http":{"id":"b43d4ea7-0b15-46f3-8728-7e393a4ea3e2","method":"POST","headers":{":authority":"e2e-shared-a-dc7d81.apps.3be3295e-9019-4b6b-9df8-99ce19d48613.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-dc7d81/rate-test-model-dc7d81/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T15:17:12Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b43d4ea7-0b15-46f3-8728-7e393a4ea3e2","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-5uXqxsAHnCoOF9Nu_dkB8pv09a8rFLpKClmZk8BqyVTXIFzzoVCoQXEQxZGr"}
{"level":"debug","ts":"2026-07-24T15:17:12Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b43d4ea7-0b15-46f3-8728-7e393a4ea3e2","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-dc7d81.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-5uXqxsAHnCoOF9Nu_dkB8pv09a8rFLpKClmZk8BqyVTXIFzzoVCoQXEQxZGr\"}"}
{"level":"debug","ts":"2026-07-24T15:17:12Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b43d4ea7-0b15-46f3-8728-7e393a4ea3e2","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-dc7d81.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"7c331479-a25c-4399-8e05-cf34ddeed09a","keyName":"e2e-rate-a-329362","subscription":"e2e-rate-iso-a-329362","tenant":"e2e-shared-a-dc7d81","userId":"7c331479-a25c-4399-8e05-cf34ddeed09a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T15:17:12Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b43d4ea7-0b15-46f3-8728-7e393a4ea3e2","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-dc7d81.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-dc7d81/rate-test-model-dc7d81\",\"requestedSubscription\":\"e2e-rate-iso-a-329362\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T15:17:12Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b43d4ea7-0b15-46f3-8728-7e393a4ea3e2","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-dc7d81.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-dc7d81","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-329362","namespace":"ai-tenant-e2e-shared-a-dc7d81","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-dc7d81/rate-test-model-dc7d81"}}
{"level":"debug","ts":"2026-07-24T15:17:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b43d4ea7-0b15-46f3-8728-7e393a4ea3e2","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T15:17:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b43d4ea7-0b15-46f3-8728-7e393a4ea3e2","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T15:17:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b43d4ea7-0b15-46f3-8728-7e393a4ea3e2","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T15:17:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b43d4ea7-0b15-46f3-8728-7e393a4ea3e2","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T15:17:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b43d4ea7-0b15-46f3-8728-7e393a4ea3e2","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-dc7d81/rate-test-model-dc7d81\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-dc7d81/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T15:17:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b43d4ea7-0b15-46f3-8728-7e393a4ea3e2","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-329362"}
{"level":"debug","ts":"2026-07-24T15:17:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b43d4ea7-0b15-46f3-8728-7e393a4ea3e2","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T15:17:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b43d4ea7-0b15-46f3-8728-7e393a4ea3e2","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T15:17:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b43d4ea7-0b15-46f3-8728-7e393a4ea3e2","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"7c331479-a25c-4399-8e05-cf34ddeed09a","keyName":"e2e-rate-a-329362","selected_subscription":"e2e-rate-iso-a-329362","selected_subscription_key":"ai-tenant-e2e-shared-a-dc7d81/e2e-rate-iso-a-329362@ai-tenant-e2e-shared-a-dc7d81/rate-test-model-dc7d81","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-dc7d81","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-329362","namespace":"ai-tenant-e2e-shared-a-dc7d81","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-dc7d81/rate-test-model-dc7d81"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T15:17:12Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b43d4ea7-0b15-46f3-8728-7e393a4ea3e2","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T15:17:12Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b43d4ea7-0b15-46f3-8728-7e393a4ea3e2","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T15:17:12Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"eb358f75-6b65-459a-9b4b-f75282c93e30","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:37498","PortSpecifier":{"PortValue":37498}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.76:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"eb358f75-6b65-459a-9b4b-f75282c93e30","method":"POST","path":"/ai-tenant-e2e-shared-b-8ea489/rate-test-model-8ea489/v1/completions","host":"e2e-shared-b-8ea489.apps.3be3295e-9019-4b6b-9df8-99ce19d48613.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T15:17:12Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"eb358f75-6b65-459a-9b4b-f75282c93e30","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:37498","PortSpecifier":{"PortValue":37498}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.76:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784906232,"nanos":519449357},"http":{"id":"eb358f75-6b65-459a-9b4b-f75282c93e30","method":"POST","headers":{":authority":"e2e-shared-b-8ea489.apps.3be3295e-9019-4b6b-9df8-99ce19d48613.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-8ea489/rate-test-model-8ea489/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T15:17:12Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"eb358f75-6b65-459a-9b4b-f75282c93e30","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1HeJO8dATJHRJXqYw_QKL5HsulJs4rgByLxPpljZIsDmoWtATxZbfrS9zzoMA"}
{"level":"debug","ts":"2026-07-24T15:17:12Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"eb358f75-6b65-459a-9b4b-f75282c93e30","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-8ea489.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1HeJO8dATJHRJXqYw_QKL5HsulJs4rgByLxPpljZIsDmoWtATxZbfrS9zzoMA\"}"}
{"level":"debug","ts":"2026-07-24T15:17:12Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"eb358f75-6b65-459a-9b4b-f75282c93e30","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-8ea489.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"d411ffcf-cb19-4320-a6dd-89792fc20544","keyName":"e2e-rate-b-329362","subscription":"e2e-rate-iso-b-329362","tenant":"e2e-shared-b-8ea489","userId":"d411ffcf-cb19-4320-a6dd-89792fc20544","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T15:17:12Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"eb358f75-6b65-459a-9b4b-f75282c93e30","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-8ea489.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-8ea489/rate-test-model-8ea489\",\"requestedSubscription\":\"e2e-rate-iso-b-329362\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T15:17:12Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"eb358f75-6b65-459a-9b4b-f75282c93e30","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-8ea489.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-8ea489","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-329362","namespace":"ai-tenant-e2e-shared-b-8ea489","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-b-8ea489/rate-test-model-8ea489"}}
{"level":"debug","ts":"2026-07-24T15:17:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"eb358f75-6b65-459a-9b4b-f75282c93e30","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T15:17:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"eb358f75-6b65-459a-9b4b-f75282c93e30","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T15:17:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"eb358f75-6b65-459a-9b4b-f75282c93e30","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T15:17:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"eb358f75-6b65-459a-9b4b-f75282c93e30","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-8ea489/rate-test-model-8ea489\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-8ea489/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T15:17:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"eb358f75-6b65-459a-9b4b-f75282c93e30","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T15:17:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"eb358f75-6b65-459a-9b4b-f75282c93e30","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-329362"}
{"level":"debug","ts":"2026-07-24T15:17:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"eb358f75-6b65-459a-9b4b-f75282c93e30","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T15:17:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"eb358f75-6b65-459a-9b4b-f75282c93e30","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T15:17:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"eb358f75-6b65-459a-9b4b-f75282c93e30","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"d411ffcf-cb19-4320-a6dd-89792fc20544","keyName":"e2e-rate-b-329362","selected_subscription":"e2e-rate-iso-b-329362","selected_subscription_key":"ai-tenant-e2e-shared-b-8ea489/e2e-rate-iso-b-329362@ai-tenant-e2e-shared-b-8ea489/rate-test-model-8ea489","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-8ea489","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-329362","namespace":"ai-tenant-e2e-shared-b-8ea489","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-b-8ea489/rate-test-model-8ea489"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T15:17:12Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"eb358f75-6b65-459a-9b4b-f75282c93e30","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T15:17:12Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"eb358f75-6b65-459a-9b4b-f75282c93e30","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T15:17:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/09bae11e466c1b7fd4a4390697823bdeb809c77799dcbe3c253ff8186111edd5"}
{"level":"info","ts":"2026-07-24T15:17:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b6afbb0129bf35ade2dff4570abfcc0353e3fe180f9f0c71ad102c06b223653d"}
{"level":"info","ts":"2026-07-24T15:17:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/55a5d4ab21bb36f7f40978ce640f1e48428a71b01d8a07eff1fd4260ceb86991"}
{"level":"info","ts":"2026-07-24T15:17:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/499f7bb1c8dda74259ca646913acc34b1ef2a1884926d433d10d853def921b85"}
{"level":"info","ts":"2026-07-24T15:17:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/894852862e694c1a8cc4de376deb5063c657089f3fdc0afc53c0b9e92dceaa71"}
{"level":"info","ts":"2026-07-24T15:17:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/83c8196c690585df78e9d0a89dac8af76b3ba3959ca1d0d967e78a6c34efdd52"}
{"level":"info","ts":"2026-07-24T15:17:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6771e3f926351e7e7eea11533db2ea5dd4b06837db63431c8ca754ee0b6658f9"}
{"level":"info","ts":"2026-07-24T15:17:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e43a58d97b85af61310417750a457e79000576dc5901f098b80a99b396ddac3e"}
{"level":"info","ts":"2026-07-24T15:17:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/8f0d3a863e4aaa3d0454c2b21d826eb257406b1e3c109355f7ec237145bacefd"}
{"level":"info","ts":"2026-07-24T15:17:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/759b45c05cdd6b3edf3f3c5ea6df90383879f1ba2513a2429afd462c751a1355"}
{"level":"info","ts":"2026-07-24T15:17:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b63e986f099db6dded059b613fdc61522ac42647ee6624458f88a0fe4a80b4c6"}
{"level":"info","ts":"2026-07-24T15:17:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/fb1c239a489ad83157cab777f895c96c594822cdbb7003bc1fdb5a2f9d4ab1c0"}
{"level":"info","ts":"2026-07-24T15:17:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9b1d53f5f7f12a77f719eed612394f0730e7fbef9e68a156b44f8b61459f8be5"}
{"level":"info","ts":"2026-07-24T15:17:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3c418244c8795aafcaa38df340a22943da5e6dc77f4f8c2d142afad2a76c0fc8"}
{"level":"info","ts":"2026-07-24T15:17:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a54aceada7cfcc76c05c9ba322b82d92df7e27cbbf943a766117a7127d669fc6"}
{"level":"info","ts":"2026-07-24T15:17:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/cac0d1ed8c9ebc34639a723d1de883cd26d05c7a3fb8fe0f74efda5642dff75a"}
{"level":"info","ts":"2026-07-24T15:17:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a475b67fc0171176cf1b95af1b4eedf3fdee92674df8efc4e08205be8a14044a"}
{"level":"info","ts":"2026-07-24T15:17:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7b1ef7cbc9f4bd6212c3657be9cf2e8359d760550e0722cee4ced1d55b2cb2d4"}
{"level":"info","ts":"2026-07-24T15:17:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b84477ba225535edbb20da780dab1124e1c77a296744f788aa6e15718c33c69a"}
{"level":"info","ts":"2026-07-24T15:17:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e0229b8129d3c1f10d17e0301e31d9d1f1c3d637f2ea292b6a5a9570bddf6082"}
{"level":"info","ts":"2026-07-24T15:17:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ce47e51606e762b3b35d49a242f02e04ddffc214b58fa99198ebb8e389bef333"}
{"level":"info","ts":"2026-07-24T15:17:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/016c0ddecb4c0887d62fd7497af33190e4653b22059f94f127356f0738724b32"}
{"level":"info","ts":"2026-07-24T15:17:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/89fb2f2d7d344454a4a5df84861dcf6c08d0309e6c7638a335fe5444338e354e"}
{"level":"info","ts":"2026-07-24T15:17:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/dd30900c228ae8cacb1f6f23d26ed55b386246809e20bac7318284c41629a1e4"}
{"level":"info","ts":"2026-07-24T15:18:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5790c6d2-b37f-4ed5-a24a-ae13971dd020","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:39574","PortSpecifier":{"PortValue":39574}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.41:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5790c6d2-b37f-4ed5-a24a-ae13971dd020","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.3be3295e-9019-4b6b-9df8-99ce19d48613.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T15:18:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5790c6d2-b37f-4ed5-a24a-ae13971dd020","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:39574","PortSpecifier":{"PortValue":39574}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.41:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784906304,"nanos":334040334},"http":{"id":"5790c6d2-b37f-4ed5-a24a-ae13971dd020","method":"POST","headers":{":authority":"maas.apps.3be3295e-9019-4b6b-9df8-99ce19d48613.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T15:18:24Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"5790c6d2-b37f-4ed5-a24a-ae13971dd020","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-24T15:18:24Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5790c6d2-b37f-4ed5-a24a-ae13971dd020","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"e9103260-9a05-4d99-8fa1-24683f35cf9c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=ac7166a7-f0ef-4ddf-98c5-a70fe2accb13"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/99ce19d48613"]}}
{"level":"debug","ts":"2026-07-24T15:18:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5790c6d2-b37f-4ed5-a24a-ae13971dd020","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/99ce19d48613"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=ac7166a7-f0ef-4ddf-98c5-a70fe2accb13"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"e9103260-9a05-4d99-8fa1-24683f35cf9c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.41:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.3be3295e-9019-4b6b-9df8-99ce19d48613.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T15:18:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5790c6d2-b37f-4ed5-a24a-ae13971dd020","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T15:18:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5790c6d2-b37f-4ed5-a24a-ae13971dd020","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T15:18:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5790c6d2-b37f-4ed5-a24a-ae13971dd020","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]},\"publishers/llm/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/llm/models/facebook/opt-125m-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T15:18:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"5790c6d2-b37f-4ed5-a24a-ae13971dd020","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-24T15:18:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5790c6d2-b37f-4ed5-a24a-ae13971dd020","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T15:18:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5790c6d2-b37f-4ed5-a24a-ae13971dd020","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-24T15:18:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5790c6d2-b37f-4ed5-a24a-ae13971dd020","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T15:18:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5790c6d2-b37f-4ed5-a24a-ae13971dd020","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T15:18:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9a2d5d4c-5a2f-4df5-badb-6fe085f0b10d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:39580","PortSpecifier":{"PortValue":39580}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.41:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9a2d5d4c-5a2f-4df5-badb-6fe085f0b10d","method":"POST","path":"/llm/facebook-opt-125m-simulated/v1/chat/completions","host":"maas.apps.3be3295e-9019-4b6b-9df8-99ce19d48613.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T15:18:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9a2d5d4c-5a2f-4df5-badb-6fe085f0b10d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:39580","PortSpecifier":{"PortValue":39580}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.41:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784906304,"nanos":377707415},"http":{"id":"9a2d5d4c-5a2f-4df5-badb-6fe085f0b10d","method":"POST","headers":{":authority":"maas.apps.3be3295e-9019-4b6b-9df8-99ce19d48613.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T15:18:24Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9a2d5d4c-5a2f-4df5-badb-6fe085f0b10d","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-vDUcGz7HPdf9e86i_QIUXO6jm9g240UEqeYR1qSPZrMtfSTW0ux4GgoZO90B"}
{"level":"debug","ts":"2026-07-24T15:18:24Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9a2d5d4c-5a2f-4df5-badb-6fe085f0b10d","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-vDUcGz7HPdf9e86i_QIUXO6jm9g240UEqeYR1qSPZrMtfSTW0ux4GgoZO90B\"}"}
{"level":"debug","ts":"2026-07-24T15:18:24Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9a2d5d4c-5a2f-4df5-badb-6fe085f0b10d","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"4ab74c2c-b64d-4236-a592-076113e8030a","keyName":"e2e-ipp-default","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"4ab74c2c-b64d-4236-a592-076113e8030a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T15:18:24Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9a2d5d4c-5a2f-4df5-badb-6fe085f0b10d","config":"subscription-info","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"simulator-subscription\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T15:18:24Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9a2d5d4c-5a2f-4df5-badb-6fe085f0b10d","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true,"resolvedModel":"llm/facebook-opt-125m-simulated"}}
{"level":"debug","ts":"2026-07-24T15:18:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9a2d5d4c-5a2f-4df5-badb-6fe085f0b10d","input":{"auth":{"identity":"Bearer **** subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true,"resolvedModel":"llm/facebook-opt-125m-simulated"}}},"context":{"context_extensions":{"host":"311b1be286674fd5684c9ac59b318287dade9769cfe4aeebd8c88e2dc6b72418"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.41:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.3be3295e-9019-4b6b-9df8-99ce19d48613.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T15:18:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9a2d5d4c-5a2f-4df5-badb-6fe085f0b10d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T15:18:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9a2d5d4c-5a2f-4df5-badb-6fe085f0b10d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T15:18:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9a2d5d4c-5a2f-4df5-badb-6fe085f0b10d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]},\"publishers/llm/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/llm/models/facebook/opt-125m-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T15:18:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9a2d5d4c-5a2f-4df5-badb-6fe085f0b10d","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T15:18:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9a2d5d4c-5a2f-4df5-badb-6fe085f0b10d","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T15:18:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9a2d5d4c-5a2f-4df5-badb-6fe085f0b10d","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T15:18:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9a2d5d4c-5a2f-4df5-badb-6fe085f0b10d","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-24T15:18:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9a2d5d4c-5a2f-4df5-badb-6fe085f0b10d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"keyId","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"4ab74c2c-b64d-4236-a592-076113e8030a","keyName":"e2e-ipp-default","selected_subscription":"simulator-subscription","selected_subscription_key":"models-as-a-service/simulator-subscription@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true,"resolvedModel":"llm/facebook-opt-125m-simulated"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T15:18:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9a2d5d4c-5a2f-4df5-badb-6fe085f0b10d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T15:18:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9a2d5d4c-5a2f-4df5-badb-6fe085f0b10d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T15:19:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4e6341ca90d08ee83ae7ae7e4793473187e4f0b0d9917fe9ebeae961b5c0399b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T15:19:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T15:19:01Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T15:19:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4e6341ca90d08ee83ae7ae7e4793473187e4f0b0d9917fe9ebeae961b5c0399b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T15:19:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4e6341ca90d08ee83ae7ae7e4793473187e4f0b0d9917fe9ebeae961b5c0399b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T15:19:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4e6341ca90d08ee83ae7ae7e4793473187e4f0b0d9917fe9ebeae961b5c0399b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T15:19:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4e6341ca90d08ee83ae7ae7e4793473187e4f0b0d9917fe9ebeae961b5c0399b"}
{"level":"debug","ts":"2026-07-24T15:19:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4e6341ca90d08ee83ae7ae7e4793473187e4f0b0d9917fe9ebeae961b5c0399b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T15:19:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4e6341ca90d08ee83ae7ae7e4793473187e4f0b0d9917fe9ebeae961b5c0399b"}
{"level":"debug","ts":"2026-07-24T15:19:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4e6341ca90d08ee83ae7ae7e4793473187e4f0b0d9917fe9ebeae961b5c0399b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T15:19:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T15:19:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4e6341ca90d08ee83ae7ae7e4793473187e4f0b0d9917fe9ebeae961b5c0399b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T15:19:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4e6341ca90d08ee83ae7ae7e4793473187e4f0b0d9917fe9ebeae961b5c0399b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T15:19:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a2eb6c5d0d22cecc8e6640d6daf679d2749f52b2202e69db5974f9a345c48c90","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T15:19:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T15:19:01Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T15:19:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a2eb6c5d0d22cecc8e6640d6daf679d2749f52b2202e69db5974f9a345c48c90","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T15:19:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4e6341ca90d08ee83ae7ae7e4793473187e4f0b0d9917fe9ebeae961b5c0399b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T15:19:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a2eb6c5d0d22cecc8e6640d6daf679d2749f52b2202e69db5974f9a345c48c90","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T15:19:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a2eb6c5d0d22cecc8e6640d6daf679d2749f52b2202e69db5974f9a345c48c90","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T15:19:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a2eb6c5d0d22cecc8e6640d6daf679d2749f52b2202e69db5974f9a345c48c90"}
{"level":"debug","ts":"2026-07-24T15:19:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a2eb6c5d0d22cecc8e6640d6daf679d2749f52b2202e69db5974f9a345c48c90","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T15:19:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T15:19:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a2eb6c5d0d22cecc8e6640d6daf679d2749f52b2202e69db5974f9a345c48c90"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T15:19:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4e6341ca90d08ee83ae7ae7e4793473187e4f0b0d9917fe9ebeae961b5c0399b"}
{"level":"info","ts":"2026-07-24T15:19:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a2eb6c5d0d22cecc8e6640d6daf679d2749f52b2202e69db5974f9a345c48c90","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T15:19:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a2eb6c5d0d22cecc8e6640d6daf679d2749f52b2202e69db5974f9a345c48c90","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T15:19:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T15:19:01Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T15:19:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a2eb6c5d0d22cecc8e6640d6daf679d2749f52b2202e69db5974f9a345c48c90"}
{"level":"info","ts":"2026-07-24T15:19:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a2eb6c5d0d22cecc8e6640d6daf679d2749f52b2202e69db5974f9a345c48c90","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T15:19:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a2eb6c5d0d22cecc8e6640d6daf679d2749f52b2202e69db5974f9a345c48c90","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T15:19:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a2eb6c5d0d22cecc8e6640d6daf679d2749f52b2202e69db5974f9a345c48c90"}
{"level":"debug","ts":"2026-07-24T15:19:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a2eb6c5d0d22cecc8e6640d6daf679d2749f52b2202e69db5974f9a345c48c90","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T15:19:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a2eb6c5d0d22cecc8e6640d6daf679d2749f52b2202e69db5974f9a345c48c90"}
{"level":"debug","ts":"2026-07-24T15:19:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a2eb6c5d0d22cecc8e6640d6daf679d2749f52b2202e69db5974f9a345c48c90","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T15:19:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T15:19:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a2eb6c5d0d22cecc8e6640d6daf679d2749f52b2202e69db5974f9a345c48c90"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T15:19:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a2eb6c5d0d22cecc8e6640d6daf679d2749f52b2202e69db5974f9a345c48c90","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T15:19:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a2eb6c5d0d22cecc8e6640d6daf679d2749f52b2202e69db5974f9a345c48c90","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T15:19:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T15:19:01Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T15:19:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a2eb6c5d0d22cecc8e6640d6daf679d2749f52b2202e69db5974f9a345c48c90"}
{"level":"info","ts":"2026-07-24T15:19:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a2eb6c5d0d22cecc8e6640d6daf679d2749f52b2202e69db5974f9a345c48c90","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T15:19:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a2eb6c5d0d22cecc8e6640d6daf679d2749f52b2202e69db5974f9a345c48c90","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T15:19:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a2eb6c5d0d22cecc8e6640d6daf679d2749f52b2202e69db5974f9a345c48c90","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T15:19:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b55f06f80108444f54123126e1c0b19a2ee1520e04c02130e2587459e38f006b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T15:19:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T15:19:01Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T15:19:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a2eb6c5d0d22cecc8e6640d6daf679d2749f52b2202e69db5974f9a345c48c90"}
{"level":"info","ts":"2026-07-24T15:19:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b55f06f80108444f54123126e1c0b19a2ee1520e04c02130e2587459e38f006b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T15:19:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a2eb6c5d0d22cecc8e6640d6daf679d2749f52b2202e69db5974f9a345c48c90","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T15:19:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T15:19:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a2eb6c5d0d22cecc8e6640d6daf679d2749f52b2202e69db5974f9a345c48c90"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T15:19:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b55f06f80108444f54123126e1c0b19a2ee1520e04c02130e2587459e38f006b"}
{"level":"info","ts":"2026-07-24T15:19:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b55f06f80108444f54123126e1c0b19a2ee1520e04c02130e2587459e38f006b"}
{"level":"info","ts":"2026-07-24T15:19:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a2eb6c5d0d22cecc8e6640d6daf679d2749f52b2202e69db5974f9a345c48c90","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T15:19:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b55f06f80108444f54123126e1c0b19a2ee1520e04c02130e2587459e38f006b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T15:19:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T15:19:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b55f06f80108444f54123126e1c0b19a2ee1520e04c02130e2587459e38f006b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T15:19:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a2eb6c5d0d22cecc8e6640d6daf679d2749f52b2202e69db5974f9a345c48c90"}
{"level":"info","ts":"2026-07-24T15:19:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b55f06f80108444f54123126e1c0b19a2ee1520e04c02130e2587459e38f006b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T15:19:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a2eb6c5d0d22cecc8e6640d6daf679d2749f52b2202e69db5974f9a345c48c90","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T15:19:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b55f06f80108444f54123126e1c0b19a2ee1520e04c02130e2587459e38f006b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T15:19:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T15:19:01Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T15:19:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b55f06f80108444f54123126e1c0b19a2ee1520e04c02130e2587459e38f006b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T15:19:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b55f06f80108444f54123126e1c0b19a2ee1520e04c02130e2587459e38f006b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T15:19:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b55f06f80108444f54123126e1c0b19a2ee1520e04c02130e2587459e38f006b"}
{"level":"debug","ts":"2026-07-24T15:19:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b55f06f80108444f54123126e1c0b19a2ee1520e04c02130e2587459e38f006b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T15:19:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b55f06f80108444f54123126e1c0b19a2ee1520e04c02130e2587459e38f006b"}
{"level":"debug","ts":"2026-07-24T15:19:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b55f06f80108444f54123126e1c0b19a2ee1520e04c02130e2587459e38f006b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T15:19:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T15:19:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b55f06f80108444f54123126e1c0b19a2ee1520e04c02130e2587459e38f006b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T15:19:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b55f06f80108444f54123126e1c0b19a2ee1520e04c02130e2587459e38f006b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T15:19:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b55f06f80108444f54123126e1c0b19a2ee1520e04c02130e2587459e38f006b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T15:19:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T15:19:01Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T15:19:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b55f06f80108444f54123126e1c0b19a2ee1520e04c02130e2587459e38f006b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T15:19:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b55f06f80108444f54123126e1c0b19a2ee1520e04c02130e2587459e38f006b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T15:19:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b55f06f80108444f54123126e1c0b19a2ee1520e04c02130e2587459e38f006b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T15:19:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b55f06f80108444f54123126e1c0b19a2ee1520e04c02130e2587459e38f006b"}
{"level":"debug","ts":"2026-07-24T15:19:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"593137e58501e12ecead0e127e24a6c3bd36eb28c3b838cdd157ad6efadf78a5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T15:19:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T15:19:01Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T15:19:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b55f06f80108444f54123126e1c0b19a2ee1520e04c02130e2587459e38f006b"}
{"level":"info","ts":"2026-07-24T15:19:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"593137e58501e12ecead0e127e24a6c3bd36eb28c3b838cdd157ad6efadf78a5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T15:19:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b55f06f80108444f54123126e1c0b19a2ee1520e04c02130e2587459e38f006b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T15:19:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T15:19:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b55f06f80108444f54123126e1c0b19a2ee1520e04c02130e2587459e38f006b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T15:19:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/593137e58501e12ecead0e127e24a6c3bd36eb28c3b838cdd157ad6efadf78a5"}
{"level":"info","ts":"2026-07-24T15:19:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b55f06f80108444f54123126e1c0b19a2ee1520e04c02130e2587459e38f006b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T15:19:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"593137e58501e12ecead0e127e24a6c3bd36eb28c3b838cdd157ad6efadf78a5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T15:19:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T15:19:01Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T15:19:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"593137e58501e12ecead0e127e24a6c3bd36eb28c3b838cdd157ad6efadf78a5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T15:19:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b55f06f80108444f54123126e1c0b19a2ee1520e04c02130e2587459e38f006b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T15:19:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"593137e58501e12ecead0e127e24a6c3bd36eb28c3b838cdd157ad6efadf78a5","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T15:19:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/593137e58501e12ecead0e127e24a6c3bd36eb28c3b838cdd157ad6efadf78a5"}
{"level":"debug","ts":"2026-07-24T15:19:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"593137e58501e12ecead0e127e24a6c3bd36eb28c3b838cdd157ad6efadf78a5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T15:19:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T15:19:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["593137e58501e12ecead0e127e24a6c3bd36eb28c3b838cdd157ad6efadf78a5"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T15:19:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b55f06f80108444f54123126e1c0b19a2ee1520e04c02130e2587459e38f006b"}
{"level":"info","ts":"2026-07-24T15:19:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"593137e58501e12ecead0e127e24a6c3bd36eb28c3b838cdd157ad6efadf78a5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T15:19:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"593137e58501e12ecead0e127e24a6c3bd36eb28c3b838cdd157ad6efadf78a5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T15:19:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T15:19:01Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T15:19:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"593137e58501e12ecead0e127e24a6c3bd36eb28c3b838cdd157ad6efadf78a5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T15:19:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"593137e58501e12ecead0e127e24a6c3bd36eb28c3b838cdd157ad6efadf78a5","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T15:19:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/593137e58501e12ecead0e127e24a6c3bd36eb28c3b838cdd157ad6efadf78a5"}
{"level":"debug","ts":"2026-07-24T15:19:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"593137e58501e12ecead0e127e24a6c3bd36eb28c3b838cdd157ad6efadf78a5","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T15:19:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/593137e58501e12ecead0e127e24a6c3bd36eb28c3b838cdd157ad6efadf78a5"}
{"level":"debug","ts":"2026-07-24T15:19:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"593137e58501e12ecead0e127e24a6c3bd36eb28c3b838cdd157ad6efadf78a5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T15:19:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T15:19:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["593137e58501e12ecead0e127e24a6c3bd36eb28c3b838cdd157ad6efadf78a5"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T15:19:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"593137e58501e12ecead0e127e24a6c3bd36eb28c3b838cdd157ad6efadf78a5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T15:19:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"593137e58501e12ecead0e127e24a6c3bd36eb28c3b838cdd157ad6efadf78a5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T15:19:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T15:19:01Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"593137e58501e12ecead0e127e24a6c3bd36eb28c3b838cdd157ad6efadf78a5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"593137e58501e12ecead0e127e24a6c3bd36eb28c3b838cdd157ad6efadf78a5","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/593137e58501e12ecead0e127e24a6c3bd36eb28c3b838cdd157ad6efadf78a5"}
{"level":"debug","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"593137e58501e12ecead0e127e24a6c3bd36eb28c3b838cdd157ad6efadf78a5","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/593137e58501e12ecead0e127e24a6c3bd36eb28c3b838cdd157ad6efadf78a5"}
{"level":"debug","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"593137e58501e12ecead0e127e24a6c3bd36eb28c3b838cdd157ad6efadf78a5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T15:19:02Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T15:19:02Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["593137e58501e12ecead0e127e24a6c3bd36eb28c3b838cdd157ad6efadf78a5"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"593137e58501e12ecead0e127e24a6c3bd36eb28c3b838cdd157ad6efadf78a5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"593137e58501e12ecead0e127e24a6c3bd36eb28c3b838cdd157ad6efadf78a5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T15:19:02Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T15:19:02Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"593137e58501e12ecead0e127e24a6c3bd36eb28c3b838cdd157ad6efadf78a5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0cd3d260cf4fe944debc85693dc1124fca18fadcc0b6d0aa5bcc0e5eebb9a29f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T15:19:02Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T15:19:02Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/593137e58501e12ecead0e127e24a6c3bd36eb28c3b838cdd157ad6efadf78a5"}
{"level":"info","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0cd3d260cf4fe944debc85693dc1124fca18fadcc0b6d0aa5bcc0e5eebb9a29f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"593137e58501e12ecead0e127e24a6c3bd36eb28c3b838cdd157ad6efadf78a5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T15:19:02Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T15:19:02Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["593137e58501e12ecead0e127e24a6c3bd36eb28c3b838cdd157ad6efadf78a5"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0cd3d260cf4fe944debc85693dc1124fca18fadcc0b6d0aa5bcc0e5eebb9a29f"}
{"level":"info","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"593137e58501e12ecead0e127e24a6c3bd36eb28c3b838cdd157ad6efadf78a5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"310fbed840060d2ffaddfd10efc4726913f7690489d4eb832ff447723823784e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T15:19:02Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T15:19:02Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"310fbed840060d2ffaddfd10efc4726913f7690489d4eb832ff447723823784e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0cd3d260cf4fe944debc85693dc1124fca18fadcc0b6d0aa5bcc0e5eebb9a29f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T15:19:02Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T15:19:02Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["0cd3d260cf4fe944debc85693dc1124fca18fadcc0b6d0aa5bcc0e5eebb9a29f"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/593137e58501e12ecead0e127e24a6c3bd36eb28c3b838cdd157ad6efadf78a5"}
{"level":"info","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0cd3d260cf4fe944debc85693dc1124fca18fadcc0b6d0aa5bcc0e5eebb9a29f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"593137e58501e12ecead0e127e24a6c3bd36eb28c3b838cdd157ad6efadf78a5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"310fbed840060d2ffaddfd10efc4726913f7690489d4eb832ff447723823784e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T15:19:02Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T15:19:02Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/310fbed840060d2ffaddfd10efc4726913f7690489d4eb832ff447723823784e"}
{"level":"info","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"310fbed840060d2ffaddfd10efc4726913f7690489d4eb832ff447723823784e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0cd3d260cf4fe944debc85693dc1124fca18fadcc0b6d0aa5bcc0e5eebb9a29f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T15:19:02Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T15:19:02Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0cd3d260cf4fe944debc85693dc1124fca18fadcc0b6d0aa5bcc0e5eebb9a29f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"310fbed840060d2ffaddfd10efc4726913f7690489d4eb832ff447723823784e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T15:19:02Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T15:19:02Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["310fbed840060d2ffaddfd10efc4726913f7690489d4eb832ff447723823784e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0cd3d260cf4fe944debc85693dc1124fca18fadcc0b6d0aa5bcc0e5eebb9a29f"}
{"level":"info","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"310fbed840060d2ffaddfd10efc4726913f7690489d4eb832ff447723823784e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0cd3d260cf4fe944debc85693dc1124fca18fadcc0b6d0aa5bcc0e5eebb9a29f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T15:19:02Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T15:19:02Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["0cd3d260cf4fe944debc85693dc1124fca18fadcc0b6d0aa5bcc0e5eebb9a29f"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/593137e58501e12ecead0e127e24a6c3bd36eb28c3b838cdd157ad6efadf78a5"}
{"level":"info","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0cd3d260cf4fe944debc85693dc1124fca18fadcc0b6d0aa5bcc0e5eebb9a29f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"310fbed840060d2ffaddfd10efc4726913f7690489d4eb832ff447723823784e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T15:19:02Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T15:19:02Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"310fbed840060d2ffaddfd10efc4726913f7690489d4eb832ff447723823784e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5601aeba088665f255601bd8ae7ced03b1a175dd3e26df5fcf62e76347ff63cd","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T15:19:02Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T15:19:02Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/310fbed840060d2ffaddfd10efc4726913f7690489d4eb832ff447723823784e"}
{"level":"info","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5601aeba088665f255601bd8ae7ced03b1a175dd3e26df5fcf62e76347ff63cd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0cd3d260cf4fe944debc85693dc1124fca18fadcc0b6d0aa5bcc0e5eebb9a29f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T15:19:02Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T15:19:02Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0cd3d260cf4fe944debc85693dc1124fca18fadcc0b6d0aa5bcc0e5eebb9a29f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"310fbed840060d2ffaddfd10efc4726913f7690489d4eb832ff447723823784e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T15:19:02Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T15:19:02Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["310fbed840060d2ffaddfd10efc4726913f7690489d4eb832ff447723823784e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0cd3d260cf4fe944debc85693dc1124fca18fadcc0b6d0aa5bcc0e5eebb9a29f"}
{"level":"info","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"310fbed840060d2ffaddfd10efc4726913f7690489d4eb832ff447723823784e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5601aeba088665f255601bd8ae7ced03b1a175dd3e26df5fcf62e76347ff63cd","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T15:19:02Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T15:19:02Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5601aeba088665f255601bd8ae7ced03b1a175dd3e26df5fcf62e76347ff63cd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0cd3d260cf4fe944debc85693dc1124fca18fadcc0b6d0aa5bcc0e5eebb9a29f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T15:19:02Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T15:19:02Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["0cd3d260cf4fe944debc85693dc1124fca18fadcc0b6d0aa5bcc0e5eebb9a29f"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0cd3d260cf4fe944debc85693dc1124fca18fadcc0b6d0aa5bcc0e5eebb9a29f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"310fbed840060d2ffaddfd10efc4726913f7690489d4eb832ff447723823784e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4807da606c52ec8945542ca44137dbdc531cbbc3f88c23c972f9d4039117465d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T15:19:02Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T15:19:02Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5601aeba088665f255601bd8ae7ced03b1a175dd3e26df5fcf62e76347ff63cd"}
{"level":"info","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4807da606c52ec8945542ca44137dbdc531cbbc3f88c23c972f9d4039117465d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5601aeba088665f255601bd8ae7ced03b1a175dd3e26df5fcf62e76347ff63cd","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T15:19:02Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T15:19:02Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["5601aeba088665f255601bd8ae7ced03b1a175dd3e26df5fcf62e76347ff63cd"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5601aeba088665f255601bd8ae7ced03b1a175dd3e26df5fcf62e76347ff63cd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3e538ca06733156df01581941c70d0f3251a01bc5175c1a04d355e16e1c44598","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T15:19:02Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T15:19:02Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/310fbed840060d2ffaddfd10efc4726913f7690489d4eb832ff447723823784e"}
{"level":"info","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3e538ca06733156df01581941c70d0f3251a01bc5175c1a04d355e16e1c44598","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0cd3d260cf4fe944debc85693dc1124fca18fadcc0b6d0aa5bcc0e5eebb9a29f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T15:19:02Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T15:19:02Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0cd3d260cf4fe944debc85693dc1124fca18fadcc0b6d0aa5bcc0e5eebb9a29f"}
{"level":"info","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0cd3d260cf4fe944debc85693dc1124fca18fadcc0b6d0aa5bcc0e5eebb9a29f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4807da606c52ec8945542ca44137dbdc531cbbc3f88c23c972f9d4039117465d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T15:19:02Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T15:19:02Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4807da606c52ec8945542ca44137dbdc531cbbc3f88c23c972f9d4039117465d"}
{"level":"info","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4807da606c52ec8945542ca44137dbdc531cbbc3f88c23c972f9d4039117465d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5601aeba088665f255601bd8ae7ced03b1a175dd3e26df5fcf62e76347ff63cd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3e538ca06733156df01581941c70d0f3251a01bc5175c1a04d355e16e1c44598","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T15:19:02Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T15:19:02Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3e538ca06733156df01581941c70d0f3251a01bc5175c1a04d355e16e1c44598","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0cd3d260cf4fe944debc85693dc1124fca18fadcc0b6d0aa5bcc0e5eebb9a29f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T15:19:02Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T15:19:02Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["0cd3d260cf4fe944debc85693dc1124fca18fadcc0b6d0aa5bcc0e5eebb9a29f"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3e538ca06733156df01581941c70d0f3251a01bc5175c1a04d355e16e1c44598"}
{"level":"info","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0cd3d260cf4fe944debc85693dc1124fca18fadcc0b6d0aa5bcc0e5eebb9a29f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4807da606c52ec8945542ca44137dbdc531cbbc3f88c23c972f9d4039117465d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T15:19:02Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T15:19:02Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4807da606c52ec8945542ca44137dbdc531cbbc3f88c23c972f9d4039117465d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5601aeba088665f255601bd8ae7ced03b1a175dd3e26df5fcf62e76347ff63cd"}
{"level":"info","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4807da606c52ec8945542ca44137dbdc531cbbc3f88c23c972f9d4039117465d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3e538ca06733156df01581941c70d0f3251a01bc5175c1a04d355e16e1c44598","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T15:19:02Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T15:19:02Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3e538ca06733156df01581941c70d0f3251a01bc5175c1a04d355e16e1c44598"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0cd3d260cf4fe944debc85693dc1124fca18fadcc0b6d0aa5bcc0e5eebb9a29f"}
{"level":"info","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3e538ca06733156df01581941c70d0f3251a01bc5175c1a04d355e16e1c44598","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0cd3d260cf4fe944debc85693dc1124fca18fadcc0b6d0aa5bcc0e5eebb9a29f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4807da606c52ec8945542ca44137dbdc531cbbc3f88c23c972f9d4039117465d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T15:19:02Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T15:19:02Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4807da606c52ec8945542ca44137dbdc531cbbc3f88c23c972f9d4039117465d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3e538ca06733156df01581941c70d0f3251a01bc5175c1a04d355e16e1c44598","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4807da606c52ec8945542ca44137dbdc531cbbc3f88c23c972f9d4039117465d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4807da606c52ec8945542ca44137dbdc531cbbc3f88c23c972f9d4039117465d"}
{"level":"debug","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4807da606c52ec8945542ca44137dbdc531cbbc3f88c23c972f9d4039117465d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T15:19:02Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T15:19:02Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4807da606c52ec8945542ca44137dbdc531cbbc3f88c23c972f9d4039117465d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4807da606c52ec8945542ca44137dbdc531cbbc3f88c23c972f9d4039117465d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4807da606c52ec8945542ca44137dbdc531cbbc3f88c23c972f9d4039117465d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"64f15c48bc8efe4b9e42d4febf29df3807c55823bc62f4d2d49c448ed7e0f0a3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T15:19:02Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T15:19:02Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3e538ca06733156df01581941c70d0f3251a01bc5175c1a04d355e16e1c44598"}
{"level":"info","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"64f15c48bc8efe4b9e42d4febf29df3807c55823bc62f4d2d49c448ed7e0f0a3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"64f15c48bc8efe4b9e42d4febf29df3807c55823bc62f4d2d49c448ed7e0f0a3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"64f15c48bc8efe4b9e42d4febf29df3807c55823bc62f4d2d49c448ed7e0f0a3","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4807da606c52ec8945542ca44137dbdc531cbbc3f88c23c972f9d4039117465d"}
{"level":"debug","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"64f15c48bc8efe4b9e42d4febf29df3807c55823bc62f4d2d49c448ed7e0f0a3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T15:19:02Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T15:19:02Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/64f15c48bc8efe4b9e42d4febf29df3807c55823bc62f4d2d49c448ed7e0f0a3"}
{"level":"info","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"64f15c48bc8efe4b9e42d4febf29df3807c55823bc62f4d2d49c448ed7e0f0a3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"64f15c48bc8efe4b9e42d4febf29df3807c55823bc62f4d2d49c448ed7e0f0a3","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/64f15c48bc8efe4b9e42d4febf29df3807c55823bc62f4d2d49c448ed7e0f0a3"}
{"level":"debug","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"64f15c48bc8efe4b9e42d4febf29df3807c55823bc62f4d2d49c448ed7e0f0a3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T15:19:02Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T15:19:02Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["64f15c48bc8efe4b9e42d4febf29df3807c55823bc62f4d2d49c448ed7e0f0a3"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"64f15c48bc8efe4b9e42d4febf29df3807c55823bc62f4d2d49c448ed7e0f0a3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"64f15c48bc8efe4b9e42d4febf29df3807c55823bc62f4d2d49c448ed7e0f0a3","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/64f15c48bc8efe4b9e42d4febf29df3807c55823bc62f4d2d49c448ed7e0f0a3"}
{"level":"debug","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e7c617a1eea000acc8ec9e59ebe21c9c1c497ee2a5ae8acf11c294f0119817ae","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T15:19:02Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T15:19:02Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e7c617a1eea000acc8ec9e59ebe21c9c1c497ee2a5ae8acf11c294f0119817ae","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"81bc37a79a68e46ff44badcff8e29e2c043e443d5dcb782d4a5c105a07bbc411","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T15:19:02Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T15:19:02Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e7c617a1eea000acc8ec9e59ebe21c9c1c497ee2a5ae8acf11c294f0119817ae"}
{"level":"info","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"81bc37a79a68e46ff44badcff8e29e2c043e443d5dcb782d4a5c105a07bbc411","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e7c617a1eea000acc8ec9e59ebe21c9c1c497ee2a5ae8acf11c294f0119817ae","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T15:19:02Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T15:19:02Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e7c617a1eea000acc8ec9e59ebe21c9c1c497ee2a5ae8acf11c294f0119817ae"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/81bc37a79a68e46ff44badcff8e29e2c043e443d5dcb782d4a5c105a07bbc411"}
{"level":"info","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e7c617a1eea000acc8ec9e59ebe21c9c1c497ee2a5ae8acf11c294f0119817ae","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"81bc37a79a68e46ff44badcff8e29e2c043e443d5dcb782d4a5c105a07bbc411","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T15:19:02Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T15:19:02Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["81bc37a79a68e46ff44badcff8e29e2c043e443d5dcb782d4a5c105a07bbc411"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e7c617a1eea000acc8ec9e59ebe21c9c1c497ee2a5ae8acf11c294f0119817ae"}
{"level":"info","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"81bc37a79a68e46ff44badcff8e29e2c043e443d5dcb782d4a5c105a07bbc411","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e7c617a1eea000acc8ec9e59ebe21c9c1c497ee2a5ae8acf11c294f0119817ae","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"81bc37a79a68e46ff44badcff8e29e2c043e443d5dcb782d4a5c105a07bbc411","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T15:19:02Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T15:19:02Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"81bc37a79a68e46ff44badcff8e29e2c043e443d5dcb782d4a5c105a07bbc411","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"81bc37a79a68e46ff44badcff8e29e2c043e443d5dcb782d4a5c105a07bbc411","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/81bc37a79a68e46ff44badcff8e29e2c043e443d5dcb782d4a5c105a07bbc411"}
{"level":"debug","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"81bc37a79a68e46ff44badcff8e29e2c043e443d5dcb782d4a5c105a07bbc411","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T15:19:02Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T15:19:02Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["81bc37a79a68e46ff44badcff8e29e2c043e443d5dcb782d4a5c105a07bbc411"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"81bc37a79a68e46ff44badcff8e29e2c043e443d5dcb782d4a5c105a07bbc411","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"81bc37a79a68e46ff44badcff8e29e2c043e443d5dcb782d4a5c105a07bbc411","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e7c617a1eea000acc8ec9e59ebe21c9c1c497ee2a5ae8acf11c294f0119817ae"}
{"level":"info","ts":"2026-07-24T15:19:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/81bc37a79a68e46ff44badcff8e29e2c043e443d5dcb782d4a5c105a07bbc411"}
{"level":"info","ts":"2026-07-24T15:19:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0fef959d-128a-430d-abba-4db73336bb1e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:52472","PortSpecifier":{"PortValue":52472}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.61:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0fef959d-128a-430d-abba-4db73336bb1e","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-ipp-a-bb95eb.apps.3be3295e-9019-4b6b-9df8-99ce19d48613.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T15:19:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0fef959d-128a-430d-abba-4db73336bb1e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:52472","PortSpecifier":{"PortValue":52472}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.61:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784906350,"nanos":54437617},"http":{"id":"0fef959d-128a-430d-abba-4db73336bb1e","method":"POST","headers":{":authority":"e2e-ipp-a-bb95eb.apps.3be3295e-9019-4b6b-9df8-99ce19d48613.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T15:19:10Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"0fef959d-128a-430d-abba-4db73336bb1e","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-24T15:19:10Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0fef959d-128a-430d-abba-4db73336bb1e","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"e9103260-9a05-4d99-8fa1-24683f35cf9c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=ac7166a7-f0ef-4ddf-98c5-a70fe2accb13"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/99ce19d48613"]}}
{"level":"debug","ts":"2026-07-24T15:19:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0fef959d-128a-430d-abba-4db73336bb1e","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/99ce19d48613"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=ac7166a7-f0ef-4ddf-98c5-a70fe2accb13"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"e9103260-9a05-4d99-8fa1-24683f35cf9c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"4807da606c52ec8945542ca44137dbdc531cbbc3f88c23c972f9d4039117465d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.61:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-ipp-a-bb95eb.apps.3be3295e-9019-4b6b-9df8-99ce19d48613.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T15:19:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0fef959d-128a-430d-abba-4db73336bb1e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T15:19:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0fef959d-128a-430d-abba-4db73336bb1e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T15:19:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0fef959d-128a-430d-abba-4db73336bb1e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-ipp-a-bb95eb/ipp-route-bb95eb\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-ipp-a-bb95eb/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T15:19:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"0fef959d-128a-430d-abba-4db73336bb1e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-24T15:19:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0fef959d-128a-430d-abba-4db73336bb1e","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T15:19:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0fef959d-128a-430d-abba-4db73336bb1e","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-24T15:19:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0fef959d-128a-430d-abba-4db73336bb1e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T15:19:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0fef959d-128a-430d-abba-4db73336bb1e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T15:19:12Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e9dad600-58ad-4e7d-9d13-674c4d0afa96","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:52486","PortSpecifier":{"PortValue":52486}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.61:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e9dad600-58ad-4e7d-9d13-674c4d0afa96","method":"POST","path":"/ai-tenant-e2e-ipp-a-bb95eb/ipp-route-bb95eb/v1/chat/completions","host":"e2e-ipp-a-bb95eb.apps.3be3295e-9019-4b6b-9df8-99ce19d48613.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T15:19:12Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e9dad600-58ad-4e7d-9d13-674c4d0afa96","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:52486","PortSpecifier":{"PortValue":52486}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.61:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784906352,"nanos":115239093},"http":{"id":"e9dad600-58ad-4e7d-9d13-674c4d0afa96","method":"POST","headers":{":authority":"e2e-ipp-a-bb95eb.apps.3be3295e-9019-4b6b-9df8-99ce19d48613.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-ipp-a-bb95eb/ipp-route-bb95eb/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T15:19:12Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e9dad600-58ad-4e7d-9d13-674c4d0afa96","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-BQE5ljAdVtxzO1pa_Nplhj4tN4MyCMlAbxHi9zXKZV5kwGnCED1CTiWIc9dU"}
{"level":"debug","ts":"2026-07-24T15:19:12Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e9dad600-58ad-4e7d-9d13-674c4d0afa96","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-ipp-a-bb95eb.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-BQE5ljAdVtxzO1pa_Nplhj4tN4MyCMlAbxHi9zXKZV5kwGnCED1CTiWIc9dU\"}"}
{"level":"debug","ts":"2026-07-24T15:19:12Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e9dad600-58ad-4e7d-9d13-674c4d0afa96","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-ipp-a-bb95eb.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"df967d42-c6ac-4ebc-aefa-f9130e8efeae","keyName":"e2e-ipp-bb95eb","subscription":"ipp-route-bb95eb-sub","tenant":"e2e-ipp-a-bb95eb","userId":"df967d42-c6ac-4ebc-aefa-f9130e8efeae","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T15:19:12Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e9dad600-58ad-4e7d-9d13-674c4d0afa96","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-ipp-a-bb95eb.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-ipp-a-bb95eb/ipp-route-bb95eb\",\"requestedSubscription\":\"ipp-route-bb95eb-sub\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T15:19:12Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e9dad600-58ad-4e7d-9d13-674c4d0afa96","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-ipp-a-bb95eb.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"ipp-route-bb95eb","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"ipp-route-bb95eb-sub","namespace":"ai-tenant-e2e-ipp-a-bb95eb","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-ipp-a-bb95eb/ipp-route-bb95eb"}}
{"level":"debug","ts":"2026-07-24T15:19:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e9dad600-58ad-4e7d-9d13-674c4d0afa96","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T15:19:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e9dad600-58ad-4e7d-9d13-674c4d0afa96","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T15:19:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e9dad600-58ad-4e7d-9d13-674c4d0afa96","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T15:19:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e9dad600-58ad-4e7d-9d13-674c4d0afa96","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-ipp-a-bb95eb/ipp-route-bb95eb\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-ipp-a-bb95eb/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T15:19:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e9dad600-58ad-4e7d-9d13-674c4d0afa96","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T15:19:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e9dad600-58ad-4e7d-9d13-674c4d0afa96","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"ipp-route-bb95eb-sub"}
{"level":"debug","ts":"2026-07-24T15:19:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e9dad600-58ad-4e7d-9d13-674c4d0afa96","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T15:19:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e9dad600-58ad-4e7d-9d13-674c4d0afa96","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T15:19:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e9dad600-58ad-4e7d-9d13-674c4d0afa96","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"df967d42-c6ac-4ebc-aefa-f9130e8efeae","keyName":"e2e-ipp-bb95eb","selected_subscription":"ipp-route-bb95eb-sub","selected_subscription_key":"ai-tenant-e2e-ipp-a-bb95eb/ipp-route-bb95eb-sub@ai-tenant-e2e-ipp-a-bb95eb/ipp-route-bb95eb","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"ipp-route-bb95eb","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"ipp-route-bb95eb-sub","namespace":"ai-tenant-e2e-ipp-a-bb95eb","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-ipp-a-bb95eb/ipp-route-bb95eb"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T15:19:12Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e9dad600-58ad-4e7d-9d13-674c4d0afa96","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T15:19:12Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e9dad600-58ad-4e7d-9d13-674c4d0afa96","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T15:20:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/81bc37a79a68e46ff44badcff8e29e2c043e443d5dcb782d4a5c105a07bbc411"}
{"level":"info","ts":"2026-07-24T15:20:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a2eb6c5d0d22cecc8e6640d6daf679d2749f52b2202e69db5974f9a345c48c90"}
{"level":"info","ts":"2026-07-24T15:20:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/593137e58501e12ecead0e127e24a6c3bd36eb28c3b838cdd157ad6efadf78a5"}
{"level":"info","ts":"2026-07-24T15:20:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/5601aeba088665f255601bd8ae7ced03b1a175dd3e26df5fcf62e76347ff63cd"}
{"level":"info","ts":"2026-07-24T15:20:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4807da606c52ec8945542ca44137dbdc531cbbc3f88c23c972f9d4039117465d"}
{"level":"info","ts":"2026-07-24T15:20:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3e538ca06733156df01581941c70d0f3251a01bc5175c1a04d355e16e1c44598"}
{"level":"info","ts":"2026-07-24T15:20:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b55f06f80108444f54123126e1c0b19a2ee1520e04c02130e2587459e38f006b"}
{"level":"info","ts":"2026-07-24T15:20:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/64f15c48bc8efe4b9e42d4febf29df3807c55823bc62f4d2d49c448ed7e0f0a3"}
{"level":"info","ts":"2026-07-24T15:20:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/310fbed840060d2ffaddfd10efc4726913f7690489d4eb832ff447723823784e"}
{"level":"info","ts":"2026-07-24T15:20:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/0cd3d260cf4fe944debc85693dc1124fca18fadcc0b6d0aa5bcc0e5eebb9a29f"}
{"level":"info","ts":"2026-07-24T15:20:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e7c617a1eea000acc8ec9e59ebe21c9c1c497ee2a5ae8acf11c294f0119817ae"}
{"level":"info","ts":"2026-07-24T15:20:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4e6341ca90d08ee83ae7ae7e4793473187e4f0b0d9917fe9ebeae961b5c0399b"}