{"level":"debug","ts":"2026-07-29T15:26:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4281558c-ac88-41f7-bca9-764d1d493295","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-c73214/rate-test-model-c73214\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-c73214/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T15:26:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4281558c-ac88-41f7-bca9-764d1d493295","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-29T15:26:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4281558c-ac88-41f7-bca9-764d1d493295","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-29T15:26:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4281558c-ac88-41f7-bca9-764d1d493295","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-8aab9d"}
{"level":"debug","ts":"2026-07-29T15:26:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4281558c-ac88-41f7-bca9-764d1d493295","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"619bf4a8-3f64-4048-9732-74eeefc881b7","keyName":"e2e-rate-a-8aab9d","selected_subscription":"e2e-rate-iso-a-8aab9d","selected_subscription_key":"ai-tenant-e2e-shared-a-c73214/e2e-rate-iso-a-8aab9d@ai-tenant-e2e-shared-a-c73214/rate-test-model-c73214","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-c73214/models/facebook/opt-125m","name":"rate-test-model-c73214","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-8aab9d","namespace":"ai-tenant-e2e-shared-a-c73214","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-c73214/rate-test-model-c73214"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-29T15:26:25Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4281558c-ac88-41f7-bca9-764d1d493295","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-29T15:26:25Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4281558c-ac88-41f7-bca9-764d1d493295","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-29T15:26:26Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3697cda3-8ec1-4067-91ed-57bfd90ea14c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:52108","PortSpecifier":{"PortValue":52108}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.38:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3697cda3-8ec1-4067-91ed-57bfd90ea14c","method":"POST","path":"/ai-tenant-e2e-shared-a-c73214/rate-test-model-c73214/v1/completions","host":"e2e-shared-a-c73214.apps.cf8a1ea2-2f33-439b-88a7-aa9ffbf16b67.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-29T15:26:26Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3697cda3-8ec1-4067-91ed-57bfd90ea14c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:52108","PortSpecifier":{"PortValue":52108}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.38:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785338786,"nanos":899754434},"http":{"id":"3697cda3-8ec1-4067-91ed-57bfd90ea14c","method":"POST","headers":{":authority":"e2e-shared-a-c73214.apps.cf8a1ea2-2f33-439b-88a7-aa9ffbf16b67.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-c73214/rate-test-model-c73214/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T15:26:26Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3697cda3-8ec1-4067-91ed-57bfd90ea14c","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-twBK2PGNUjrSAxLY_gQqx2duIdfO3WS5jKR7qo18ei3li0jdO5zgi6O3bE4A"}
{"level":"debug","ts":"2026-07-29T15:26:26Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3697cda3-8ec1-4067-91ed-57bfd90ea14c","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-c73214.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-twBK2PGNUjrSAxLY_gQqx2duIdfO3WS5jKR7qo18ei3li0jdO5zgi6O3bE4A\"}"}
{"level":"debug","ts":"2026-07-29T15:26:26Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3697cda3-8ec1-4067-91ed-57bfd90ea14c","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-c73214.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"619bf4a8-3f64-4048-9732-74eeefc881b7","keyName":"e2e-rate-a-8aab9d","subscription":"e2e-rate-iso-a-8aab9d","tenant":"e2e-shared-a-c73214","userId":"619bf4a8-3f64-4048-9732-74eeefc881b7","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-29T15:26:26Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3697cda3-8ec1-4067-91ed-57bfd90ea14c","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-c73214.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-c73214/rate-test-model-c73214\",\"requestedSubscription\":\"e2e-rate-iso-a-8aab9d\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-29T15:26:26Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3697cda3-8ec1-4067-91ed-57bfd90ea14c","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-c73214.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-c73214/models/facebook/opt-125m","name":"rate-test-model-c73214","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-8aab9d","namespace":"ai-tenant-e2e-shared-a-c73214","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-c73214/rate-test-model-c73214"}}
{"level":"debug","ts":"2026-07-29T15:26:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3697cda3-8ec1-4067-91ed-57bfd90ea14c","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T15:26:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3697cda3-8ec1-4067-91ed-57bfd90ea14c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T15:26:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3697cda3-8ec1-4067-91ed-57bfd90ea14c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T15:26:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3697cda3-8ec1-4067-91ed-57bfd90ea14c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-c73214/rate-test-model-c73214\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-c73214/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T15:26:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3697cda3-8ec1-4067-91ed-57bfd90ea14c","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T15:26:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3697cda3-8ec1-4067-91ed-57bfd90ea14c","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-29T15:26:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3697cda3-8ec1-4067-91ed-57bfd90ea14c","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-8aab9d"}
{"level":"debug","ts":"2026-07-29T15:26:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3697cda3-8ec1-4067-91ed-57bfd90ea14c","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-29T15:26:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3697cda3-8ec1-4067-91ed-57bfd90ea14c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"619bf4a8-3f64-4048-9732-74eeefc881b7","keyName":"e2e-rate-a-8aab9d","selected_subscription":"e2e-rate-iso-a-8aab9d","selected_subscription_key":"ai-tenant-e2e-shared-a-c73214/e2e-rate-iso-a-8aab9d@ai-tenant-e2e-shared-a-c73214/rate-test-model-c73214","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-c73214/models/facebook/opt-125m","name":"rate-test-model-c73214","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-8aab9d","namespace":"ai-tenant-e2e-shared-a-c73214","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-c73214/rate-test-model-c73214"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-29T15:26:26Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3697cda3-8ec1-4067-91ed-57bfd90ea14c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-29T15:26:26Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3697cda3-8ec1-4067-91ed-57bfd90ea14c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-29T15:26:27Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0f519f82-a2ff-4d8f-ac5c-7aea5f575b8c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:52120","PortSpecifier":{"PortValue":52120}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.38:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0f519f82-a2ff-4d8f-ac5c-7aea5f575b8c","method":"POST","path":"/ai-tenant-e2e-shared-a-c73214/rate-test-model-c73214/v1/completions","host":"e2e-shared-a-c73214.apps.cf8a1ea2-2f33-439b-88a7-aa9ffbf16b67.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-29T15:26:27Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0f519f82-a2ff-4d8f-ac5c-7aea5f575b8c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:52120","PortSpecifier":{"PortValue":52120}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.38:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785338787,"nanos":940453565},"http":{"id":"0f519f82-a2ff-4d8f-ac5c-7aea5f575b8c","method":"POST","headers":{":authority":"e2e-shared-a-c73214.apps.cf8a1ea2-2f33-439b-88a7-aa9ffbf16b67.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-c73214/rate-test-model-c73214/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T15:26:27Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0f519f82-a2ff-4d8f-ac5c-7aea5f575b8c","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-twBK2PGNUjrSAxLY_gQqx2duIdfO3WS5jKR7qo18ei3li0jdO5zgi6O3bE4A"}
{"level":"debug","ts":"2026-07-29T15:26:27Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0f519f82-a2ff-4d8f-ac5c-7aea5f575b8c","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-c73214.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-twBK2PGNUjrSAxLY_gQqx2duIdfO3WS5jKR7qo18ei3li0jdO5zgi6O3bE4A\"}"}
{"level":"debug","ts":"2026-07-29T15:26:27Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0f519f82-a2ff-4d8f-ac5c-7aea5f575b8c","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-c73214.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"619bf4a8-3f64-4048-9732-74eeefc881b7","keyName":"e2e-rate-a-8aab9d","subscription":"e2e-rate-iso-a-8aab9d","tenant":"e2e-shared-a-c73214","userId":"619bf4a8-3f64-4048-9732-74eeefc881b7","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-29T15:26:27Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0f519f82-a2ff-4d8f-ac5c-7aea5f575b8c","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-c73214.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-c73214/rate-test-model-c73214\",\"requestedSubscription\":\"e2e-rate-iso-a-8aab9d\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-29T15:26:27Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0f519f82-a2ff-4d8f-ac5c-7aea5f575b8c","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-c73214.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-c73214/models/facebook/opt-125m","name":"rate-test-model-c73214","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-8aab9d","namespace":"ai-tenant-e2e-shared-a-c73214","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-c73214/rate-test-model-c73214"}}
{"level":"debug","ts":"2026-07-29T15:26:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0f519f82-a2ff-4d8f-ac5c-7aea5f575b8c","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T15:26:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0f519f82-a2ff-4d8f-ac5c-7aea5f575b8c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T15:26:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0f519f82-a2ff-4d8f-ac5c-7aea5f575b8c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T15:26:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0f519f82-a2ff-4d8f-ac5c-7aea5f575b8c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-c73214/rate-test-model-c73214\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-c73214/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T15:26:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0f519f82-a2ff-4d8f-ac5c-7aea5f575b8c","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T15:26:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0f519f82-a2ff-4d8f-ac5c-7aea5f575b8c","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-8aab9d"}
{"level":"debug","ts":"2026-07-29T15:26:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0f519f82-a2ff-4d8f-ac5c-7aea5f575b8c","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-29T15:26:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0f519f82-a2ff-4d8f-ac5c-7aea5f575b8c","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-29T15:26:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0f519f82-a2ff-4d8f-ac5c-7aea5f575b8c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"619bf4a8-3f64-4048-9732-74eeefc881b7","keyName":"e2e-rate-a-8aab9d","selected_subscription":"e2e-rate-iso-a-8aab9d","selected_subscription_key":"ai-tenant-e2e-shared-a-c73214/e2e-rate-iso-a-8aab9d@ai-tenant-e2e-shared-a-c73214/rate-test-model-c73214","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-c73214/models/facebook/opt-125m","name":"rate-test-model-c73214","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-8aab9d","namespace":"ai-tenant-e2e-shared-a-c73214","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-c73214/rate-test-model-c73214"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-29T15:26:27Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0f519f82-a2ff-4d8f-ac5c-7aea5f575b8c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-29T15:26:27Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0f519f82-a2ff-4d8f-ac5c-7aea5f575b8c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-29T15:26:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"88341191-3349-4b95-8a44-1203f63168ad","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:34412","PortSpecifier":{"PortValue":34412}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.38:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"88341191-3349-4b95-8a44-1203f63168ad","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-c73214.apps.cf8a1ea2-2f33-439b-88a7-aa9ffbf16b67.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-29T15:26:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"88341191-3349-4b95-8a44-1203f63168ad","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:34412","PortSpecifier":{"PortValue":34412}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.38:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785338805,"nanos":11509955},"http":{"id":"88341191-3349-4b95-8a44-1203f63168ad","method":"POST","headers":{":authority":"e2e-shared-a-c73214.apps.cf8a1ea2-2f33-439b-88a7-aa9ffbf16b67.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T15:26:45Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"88341191-3349-4b95-8a44-1203f63168ad","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-29T15:26:45Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"88341191-3349-4b95-8a44-1203f63168ad","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"3ea24739-528b-4fc8-922d-d3e64a5d5dc1","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4e41eb26-42ce-4777-9f69-a28d16cdabc6"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/aa9ffbf16b67"]}}
{"level":"debug","ts":"2026-07-29T15:26:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"88341191-3349-4b95-8a44-1203f63168ad","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/aa9ffbf16b67"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4e41eb26-42ce-4777-9f69-a28d16cdabc6"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"3ea24739-528b-4fc8-922d-d3e64a5d5dc1","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"3cc6d08616dc4681221a4d92d662450a8bdcece9522de55b84eeb58edd43c06c"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.38:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-c73214.apps.cf8a1ea2-2f33-439b-88a7-aa9ffbf16b67.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T15:26:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"88341191-3349-4b95-8a44-1203f63168ad","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T15:26:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"88341191-3349-4b95-8a44-1203f63168ad","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T15:26:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"88341191-3349-4b95-8a44-1203f63168ad","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-c73214/rate-test-model-c73214\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-c73214/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T15:26:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"88341191-3349-4b95-8a44-1203f63168ad","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-29T15:26:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"88341191-3349-4b95-8a44-1203f63168ad","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-29T15:26:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"88341191-3349-4b95-8a44-1203f63168ad","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-29T15:26:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"88341191-3349-4b95-8a44-1203f63168ad","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-29T15:26:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"88341191-3349-4b95-8a44-1203f63168ad","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-29T15:26:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e4a5ea82-aad0-4f39-8671-03656e5b3fe0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:36932","PortSpecifier":{"PortValue":36932}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.70:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e4a5ea82-aad0-4f39-8671-03656e5b3fe0","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-93e799.apps.cf8a1ea2-2f33-439b-88a7-aa9ffbf16b67.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-29T15:26:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e4a5ea82-aad0-4f39-8671-03656e5b3fe0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:36932","PortSpecifier":{"PortValue":36932}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.70:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785338805,"nanos":51303802},"http":{"id":"e4a5ea82-aad0-4f39-8671-03656e5b3fe0","method":"POST","headers":{":authority":"e2e-shared-b-93e799.apps.cf8a1ea2-2f33-439b-88a7-aa9ffbf16b67.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T15:26:45Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"e4a5ea82-aad0-4f39-8671-03656e5b3fe0","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-29T15:26:45Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e4a5ea82-aad0-4f39-8671-03656e5b3fe0","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"3ea24739-528b-4fc8-922d-d3e64a5d5dc1","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4e41eb26-42ce-4777-9f69-a28d16cdabc6"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/aa9ffbf16b67"]}}
{"level":"debug","ts":"2026-07-29T15:26:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e4a5ea82-aad0-4f39-8671-03656e5b3fe0","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/aa9ffbf16b67"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4e41eb26-42ce-4777-9f69-a28d16cdabc6"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"3ea24739-528b-4fc8-922d-d3e64a5d5dc1","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b26a9417cbf0a79b8ca790fdb55ada7f9008dc435e25ee3be0c66cd3481b63dd"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.70:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-93e799.apps.cf8a1ea2-2f33-439b-88a7-aa9ffbf16b67.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T15:26:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e4a5ea82-aad0-4f39-8671-03656e5b3fe0","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T15:26:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e4a5ea82-aad0-4f39-8671-03656e5b3fe0","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T15:26:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e4a5ea82-aad0-4f39-8671-03656e5b3fe0","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-93e799/rate-test-model-93e799\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-93e799/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T15:26:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"e4a5ea82-aad0-4f39-8671-03656e5b3fe0","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-29T15:26:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e4a5ea82-aad0-4f39-8671-03656e5b3fe0","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-29T15:26:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e4a5ea82-aad0-4f39-8671-03656e5b3fe0","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-29T15:26:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e4a5ea82-aad0-4f39-8671-03656e5b3fe0","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-29T15:26:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e4a5ea82-aad0-4f39-8671-03656e5b3fe0","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-29T15:26:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"22605e91-a30c-4e25-8ec5-7b726640190f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:34418","PortSpecifier":{"PortValue":34418}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.38:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"22605e91-a30c-4e25-8ec5-7b726640190f","method":"POST","path":"/ai-tenant-e2e-shared-a-c73214/rate-test-model-c73214/v1/completions","host":"e2e-shared-a-c73214.apps.cf8a1ea2-2f33-439b-88a7-aa9ffbf16b67.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-29T15:26:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"22605e91-a30c-4e25-8ec5-7b726640190f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:34418","PortSpecifier":{"PortValue":34418}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.38:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785338805,"nanos":92365426},"http":{"id":"22605e91-a30c-4e25-8ec5-7b726640190f","method":"POST","headers":{":authority":"e2e-shared-a-c73214.apps.cf8a1ea2-2f33-439b-88a7-aa9ffbf16b67.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-c73214/rate-test-model-c73214/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T15:26:45Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"22605e91-a30c-4e25-8ec5-7b726640190f","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-LXI8ZABjQ8BKj5wh_nMltf2fwVISsYwQq3rCeOfpGGTHLXMcZLdWmemnDaF"}
{"level":"debug","ts":"2026-07-29T15:26:45Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"22605e91-a30c-4e25-8ec5-7b726640190f","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-c73214.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-LXI8ZABjQ8BKj5wh_nMltf2fwVISsYwQq3rCeOfpGGTHLXMcZLdWmemnDaF\"}"}
{"level":"debug","ts":"2026-07-29T15:26:45Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"22605e91-a30c-4e25-8ec5-7b726640190f","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-c73214.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"4e1ae7c5-b4da-43bb-8b50-837119224226","keyName":"e2e-rate-a-9eaa69","subscription":"e2e-rate-iso-a-9eaa69","tenant":"e2e-shared-a-c73214","userId":"4e1ae7c5-b4da-43bb-8b50-837119224226","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-29T15:26:45Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"22605e91-a30c-4e25-8ec5-7b726640190f","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-c73214.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-c73214/rate-test-model-c73214\",\"requestedSubscription\":\"e2e-rate-iso-a-9eaa69\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-29T15:26:45Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"22605e91-a30c-4e25-8ec5-7b726640190f","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-c73214.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-c73214/models/facebook/opt-125m","name":"rate-test-model-c73214","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-9eaa69","namespace":"ai-tenant-e2e-shared-a-c73214","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-c73214/rate-test-model-c73214"}}
{"level":"debug","ts":"2026-07-29T15:26:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"22605e91-a30c-4e25-8ec5-7b726640190f","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T15:26:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"22605e91-a30c-4e25-8ec5-7b726640190f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T15:26:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"22605e91-a30c-4e25-8ec5-7b726640190f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T15:26:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"22605e91-a30c-4e25-8ec5-7b726640190f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-c73214/rate-test-model-c73214\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-c73214/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T15:26:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"22605e91-a30c-4e25-8ec5-7b726640190f","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T15:26:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"22605e91-a30c-4e25-8ec5-7b726640190f","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-29T15:26:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"22605e91-a30c-4e25-8ec5-7b726640190f","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-29T15:26:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"22605e91-a30c-4e25-8ec5-7b726640190f","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-9eaa69"}
{"level":"debug","ts":"2026-07-29T15:26:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"22605e91-a30c-4e25-8ec5-7b726640190f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"4e1ae7c5-b4da-43bb-8b50-837119224226","keyName":"e2e-rate-a-9eaa69","selected_subscription":"e2e-rate-iso-a-9eaa69","selected_subscription_key":"ai-tenant-e2e-shared-a-c73214/e2e-rate-iso-a-9eaa69@ai-tenant-e2e-shared-a-c73214/rate-test-model-c73214","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-c73214/models/facebook/opt-125m","name":"rate-test-model-c73214","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-9eaa69","namespace":"ai-tenant-e2e-shared-a-c73214","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-c73214/rate-test-model-c73214"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-29T15:26:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"22605e91-a30c-4e25-8ec5-7b726640190f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-29T15:26:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"22605e91-a30c-4e25-8ec5-7b726640190f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-29T15:26:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f1062b4a-9405-4347-a5fc-fc004019214a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:34430","PortSpecifier":{"PortValue":34430}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.38:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f1062b4a-9405-4347-a5fc-fc004019214a","method":"POST","path":"/ai-tenant-e2e-shared-a-c73214/rate-test-model-c73214/v1/completions","host":"e2e-shared-a-c73214.apps.cf8a1ea2-2f33-439b-88a7-aa9ffbf16b67.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-29T15:26:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f1062b4a-9405-4347-a5fc-fc004019214a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:34430","PortSpecifier":{"PortValue":34430}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.38:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785338806,"nanos":137543334},"http":{"id":"f1062b4a-9405-4347-a5fc-fc004019214a","method":"POST","headers":{":authority":"e2e-shared-a-c73214.apps.cf8a1ea2-2f33-439b-88a7-aa9ffbf16b67.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-c73214/rate-test-model-c73214/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T15:26:46Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f1062b4a-9405-4347-a5fc-fc004019214a","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-LXI8ZABjQ8BKj5wh_nMltf2fwVISsYwQq3rCeOfpGGTHLXMcZLdWmemnDaF"}
{"level":"debug","ts":"2026-07-29T15:26:46Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f1062b4a-9405-4347-a5fc-fc004019214a","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-c73214.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-LXI8ZABjQ8BKj5wh_nMltf2fwVISsYwQq3rCeOfpGGTHLXMcZLdWmemnDaF\"}"}
{"level":"debug","ts":"2026-07-29T15:26:46Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f1062b4a-9405-4347-a5fc-fc004019214a","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-c73214.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"4e1ae7c5-b4da-43bb-8b50-837119224226","keyName":"e2e-rate-a-9eaa69","subscription":"e2e-rate-iso-a-9eaa69","tenant":"e2e-shared-a-c73214","userId":"4e1ae7c5-b4da-43bb-8b50-837119224226","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-29T15:26:46Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f1062b4a-9405-4347-a5fc-fc004019214a","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-c73214.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-c73214/rate-test-model-c73214\",\"requestedSubscription\":\"e2e-rate-iso-a-9eaa69\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-29T15:26:46Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f1062b4a-9405-4347-a5fc-fc004019214a","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-c73214.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-c73214/models/facebook/opt-125m","name":"rate-test-model-c73214","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-9eaa69","namespace":"ai-tenant-e2e-shared-a-c73214","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-c73214/rate-test-model-c73214"}}
{"level":"debug","ts":"2026-07-29T15:26:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f1062b4a-9405-4347-a5fc-fc004019214a","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T15:26:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f1062b4a-9405-4347-a5fc-fc004019214a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T15:26:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f1062b4a-9405-4347-a5fc-fc004019214a","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T15:26:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f1062b4a-9405-4347-a5fc-fc004019214a","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-c73214/rate-test-model-c73214\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-c73214/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T15:26:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f1062b4a-9405-4347-a5fc-fc004019214a","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T15:26:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f1062b4a-9405-4347-a5fc-fc004019214a","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-29T15:26:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f1062b4a-9405-4347-a5fc-fc004019214a","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-9eaa69"}
{"level":"debug","ts":"2026-07-29T15:26:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f1062b4a-9405-4347-a5fc-fc004019214a","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-29T15:26:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f1062b4a-9405-4347-a5fc-fc004019214a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"4e1ae7c5-b4da-43bb-8b50-837119224226","keyName":"e2e-rate-a-9eaa69","selected_subscription":"e2e-rate-iso-a-9eaa69","selected_subscription_key":"ai-tenant-e2e-shared-a-c73214/e2e-rate-iso-a-9eaa69@ai-tenant-e2e-shared-a-c73214/rate-test-model-c73214","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-c73214/models/facebook/opt-125m","name":"rate-test-model-c73214","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-9eaa69","namespace":"ai-tenant-e2e-shared-a-c73214","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-c73214/rate-test-model-c73214"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-29T15:26:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f1062b4a-9405-4347-a5fc-fc004019214a","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-29T15:26:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f1062b4a-9405-4347-a5fc-fc004019214a","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-29T15:26:47Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"19049a06-fe88-459c-924c-9e8a931ef464","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:39864","PortSpecifier":{"PortValue":39864}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.38:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"19049a06-fe88-459c-924c-9e8a931ef464","method":"POST","path":"/ai-tenant-e2e-shared-a-c73214/rate-test-model-c73214/v1/completions","host":"e2e-shared-a-c73214.apps.cf8a1ea2-2f33-439b-88a7-aa9ffbf16b67.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-29T15:26:47Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"19049a06-fe88-459c-924c-9e8a931ef464","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:39864","PortSpecifier":{"PortValue":39864}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.38:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785338807,"nanos":187505021},"http":{"id":"19049a06-fe88-459c-924c-9e8a931ef464","method":"POST","headers":{":authority":"e2e-shared-a-c73214.apps.cf8a1ea2-2f33-439b-88a7-aa9ffbf16b67.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-c73214/rate-test-model-c73214/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T15:26:47Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"19049a06-fe88-459c-924c-9e8a931ef464","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-LXI8ZABjQ8BKj5wh_nMltf2fwVISsYwQq3rCeOfpGGTHLXMcZLdWmemnDaF"}
{"level":"debug","ts":"2026-07-29T15:26:47Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"19049a06-fe88-459c-924c-9e8a931ef464","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-c73214.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-LXI8ZABjQ8BKj5wh_nMltf2fwVISsYwQq3rCeOfpGGTHLXMcZLdWmemnDaF\"}"}
{"level":"debug","ts":"2026-07-29T15:26:47Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"19049a06-fe88-459c-924c-9e8a931ef464","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-c73214.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"4e1ae7c5-b4da-43bb-8b50-837119224226","keyName":"e2e-rate-a-9eaa69","subscription":"e2e-rate-iso-a-9eaa69","tenant":"e2e-shared-a-c73214","userId":"4e1ae7c5-b4da-43bb-8b50-837119224226","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-29T15:26:47Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"19049a06-fe88-459c-924c-9e8a931ef464","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-c73214.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-c73214/rate-test-model-c73214\",\"requestedSubscription\":\"e2e-rate-iso-a-9eaa69\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-29T15:26:47Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"19049a06-fe88-459c-924c-9e8a931ef464","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-c73214.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-c73214/models/facebook/opt-125m","name":"rate-test-model-c73214","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-9eaa69","namespace":"ai-tenant-e2e-shared-a-c73214","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-c73214/rate-test-model-c73214"}}
{"level":"debug","ts":"2026-07-29T15:26:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"19049a06-fe88-459c-924c-9e8a931ef464","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T15:26:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"19049a06-fe88-459c-924c-9e8a931ef464","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T15:26:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"19049a06-fe88-459c-924c-9e8a931ef464","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T15:26:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"19049a06-fe88-459c-924c-9e8a931ef464","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-c73214/rate-test-model-c73214\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-c73214/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T15:26:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"19049a06-fe88-459c-924c-9e8a931ef464","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T15:26:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"19049a06-fe88-459c-924c-9e8a931ef464","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-29T15:26:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"19049a06-fe88-459c-924c-9e8a931ef464","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-9eaa69"}
{"level":"debug","ts":"2026-07-29T15:26:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"19049a06-fe88-459c-924c-9e8a931ef464","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-29T15:26:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"19049a06-fe88-459c-924c-9e8a931ef464","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"4e1ae7c5-b4da-43bb-8b50-837119224226","keyName":"e2e-rate-a-9eaa69","selected_subscription":"e2e-rate-iso-a-9eaa69","selected_subscription_key":"ai-tenant-e2e-shared-a-c73214/e2e-rate-iso-a-9eaa69@ai-tenant-e2e-shared-a-c73214/rate-test-model-c73214","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-c73214/models/facebook/opt-125m","name":"rate-test-model-c73214","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-9eaa69","namespace":"ai-tenant-e2e-shared-a-c73214","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-c73214/rate-test-model-c73214"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-29T15:26:47Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"19049a06-fe88-459c-924c-9e8a931ef464","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-29T15:26:47Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"19049a06-fe88-459c-924c-9e8a931ef464","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-29T15:26:48Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6e035d9c-d57e-4ab1-aa4f-6a0429443f6f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:39878","PortSpecifier":{"PortValue":39878}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.38:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6e035d9c-d57e-4ab1-aa4f-6a0429443f6f","method":"POST","path":"/ai-tenant-e2e-shared-a-c73214/rate-test-model-c73214/v1/completions","host":"e2e-shared-a-c73214.apps.cf8a1ea2-2f33-439b-88a7-aa9ffbf16b67.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-29T15:26:48Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6e035d9c-d57e-4ab1-aa4f-6a0429443f6f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:39878","PortSpecifier":{"PortValue":39878}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.38:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785338808,"nanos":225189837},"http":{"id":"6e035d9c-d57e-4ab1-aa4f-6a0429443f6f","method":"POST","headers":{":authority":"e2e-shared-a-c73214.apps.cf8a1ea2-2f33-439b-88a7-aa9ffbf16b67.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-c73214/rate-test-model-c73214/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T15:26:48Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6e035d9c-d57e-4ab1-aa4f-6a0429443f6f","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-LXI8ZABjQ8BKj5wh_nMltf2fwVISsYwQq3rCeOfpGGTHLXMcZLdWmemnDaF"}
{"level":"debug","ts":"2026-07-29T15:26:48Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6e035d9c-d57e-4ab1-aa4f-6a0429443f6f","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-c73214.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-LXI8ZABjQ8BKj5wh_nMltf2fwVISsYwQq3rCeOfpGGTHLXMcZLdWmemnDaF\"}"}
{"level":"debug","ts":"2026-07-29T15:26:48Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6e035d9c-d57e-4ab1-aa4f-6a0429443f6f","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-c73214.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"4e1ae7c5-b4da-43bb-8b50-837119224226","keyName":"e2e-rate-a-9eaa69","subscription":"e2e-rate-iso-a-9eaa69","tenant":"e2e-shared-a-c73214","userId":"4e1ae7c5-b4da-43bb-8b50-837119224226","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-29T15:26:48Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6e035d9c-d57e-4ab1-aa4f-6a0429443f6f","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-c73214.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-c73214/rate-test-model-c73214\",\"requestedSubscription\":\"e2e-rate-iso-a-9eaa69\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-29T15:26:48Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6e035d9c-d57e-4ab1-aa4f-6a0429443f6f","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-c73214.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-c73214/models/facebook/opt-125m","name":"rate-test-model-c73214","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-9eaa69","namespace":"ai-tenant-e2e-shared-a-c73214","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-c73214/rate-test-model-c73214"}}
{"level":"debug","ts":"2026-07-29T15:26:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6e035d9c-d57e-4ab1-aa4f-6a0429443f6f","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T15:26:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6e035d9c-d57e-4ab1-aa4f-6a0429443f6f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T15:26:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6e035d9c-d57e-4ab1-aa4f-6a0429443f6f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T15:26:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6e035d9c-d57e-4ab1-aa4f-6a0429443f6f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-c73214/rate-test-model-c73214\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-c73214/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T15:26:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6e035d9c-d57e-4ab1-aa4f-6a0429443f6f","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T15:26:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6e035d9c-d57e-4ab1-aa4f-6a0429443f6f","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-29T15:26:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6e035d9c-d57e-4ab1-aa4f-6a0429443f6f","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-9eaa69"}
{"level":"debug","ts":"2026-07-29T15:26:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6e035d9c-d57e-4ab1-aa4f-6a0429443f6f","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-29T15:26:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6e035d9c-d57e-4ab1-aa4f-6a0429443f6f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"4e1ae7c5-b4da-43bb-8b50-837119224226","keyName":"e2e-rate-a-9eaa69","selected_subscription":"e2e-rate-iso-a-9eaa69","selected_subscription_key":"ai-tenant-e2e-shared-a-c73214/e2e-rate-iso-a-9eaa69@ai-tenant-e2e-shared-a-c73214/rate-test-model-c73214","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-c73214/models/facebook/opt-125m","name":"rate-test-model-c73214","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-9eaa69","namespace":"ai-tenant-e2e-shared-a-c73214","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-c73214/rate-test-model-c73214"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-29T15:26:48Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6e035d9c-d57e-4ab1-aa4f-6a0429443f6f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-29T15:26:48Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6e035d9c-d57e-4ab1-aa4f-6a0429443f6f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-29T15:26:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c49ce301-a6b1-47ac-a7e3-ce9b521b2bcd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:39886","PortSpecifier":{"PortValue":39886}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.38:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c49ce301-a6b1-47ac-a7e3-ce9b521b2bcd","method":"POST","path":"/ai-tenant-e2e-shared-a-c73214/rate-test-model-c73214/v1/completions","host":"e2e-shared-a-c73214.apps.cf8a1ea2-2f33-439b-88a7-aa9ffbf16b67.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-29T15:26:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c49ce301-a6b1-47ac-a7e3-ce9b521b2bcd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:39886","PortSpecifier":{"PortValue":39886}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.38:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785338809,"nanos":268635663},"http":{"id":"c49ce301-a6b1-47ac-a7e3-ce9b521b2bcd","method":"POST","headers":{":authority":"e2e-shared-a-c73214.apps.cf8a1ea2-2f33-439b-88a7-aa9ffbf16b67.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-c73214/rate-test-model-c73214/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T15:26:49Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"c49ce301-a6b1-47ac-a7e3-ce9b521b2bcd","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-LXI8ZABjQ8BKj5wh_nMltf2fwVISsYwQq3rCeOfpGGTHLXMcZLdWmemnDaF"}
{"level":"debug","ts":"2026-07-29T15:26:49Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c49ce301-a6b1-47ac-a7e3-ce9b521b2bcd","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-c73214.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-LXI8ZABjQ8BKj5wh_nMltf2fwVISsYwQq3rCeOfpGGTHLXMcZLdWmemnDaF\"}"}
{"level":"debug","ts":"2026-07-29T15:26:49Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c49ce301-a6b1-47ac-a7e3-ce9b521b2bcd","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-c73214.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"4e1ae7c5-b4da-43bb-8b50-837119224226","keyName":"e2e-rate-a-9eaa69","subscription":"e2e-rate-iso-a-9eaa69","tenant":"e2e-shared-a-c73214","userId":"4e1ae7c5-b4da-43bb-8b50-837119224226","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-29T15:26:49Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c49ce301-a6b1-47ac-a7e3-ce9b521b2bcd","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-c73214.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-c73214/rate-test-model-c73214\",\"requestedSubscription\":\"e2e-rate-iso-a-9eaa69\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-29T15:26:49Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c49ce301-a6b1-47ac-a7e3-ce9b521b2bcd","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-c73214.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-c73214/models/facebook/opt-125m","name":"rate-test-model-c73214","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-9eaa69","namespace":"ai-tenant-e2e-shared-a-c73214","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-c73214/rate-test-model-c73214"}}
{"level":"debug","ts":"2026-07-29T15:26:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"c49ce301-a6b1-47ac-a7e3-ce9b521b2bcd","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T15:26:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c49ce301-a6b1-47ac-a7e3-ce9b521b2bcd","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T15:26:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c49ce301-a6b1-47ac-a7e3-ce9b521b2bcd","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T15:26:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c49ce301-a6b1-47ac-a7e3-ce9b521b2bcd","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-c73214/rate-test-model-c73214\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-c73214/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T15:26:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c49ce301-a6b1-47ac-a7e3-ce9b521b2bcd","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T15:26:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c49ce301-a6b1-47ac-a7e3-ce9b521b2bcd","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-29T15:26:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c49ce301-a6b1-47ac-a7e3-ce9b521b2bcd","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-9eaa69"}
{"level":"debug","ts":"2026-07-29T15:26:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c49ce301-a6b1-47ac-a7e3-ce9b521b2bcd","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-29T15:26:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c49ce301-a6b1-47ac-a7e3-ce9b521b2bcd","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"4e1ae7c5-b4da-43bb-8b50-837119224226","keyName":"e2e-rate-a-9eaa69","selected_subscription":"e2e-rate-iso-a-9eaa69","selected_subscription_key":"ai-tenant-e2e-shared-a-c73214/e2e-rate-iso-a-9eaa69@ai-tenant-e2e-shared-a-c73214/rate-test-model-c73214","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-c73214/models/facebook/opt-125m","name":"rate-test-model-c73214","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-9eaa69","namespace":"ai-tenant-e2e-shared-a-c73214","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-c73214/rate-test-model-c73214"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-29T15:26:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c49ce301-a6b1-47ac-a7e3-ce9b521b2bcd","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-29T15:26:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c49ce301-a6b1-47ac-a7e3-ce9b521b2bcd","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-29T15:26:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"80f51974-3533-490b-9dc8-60e73bb90c0a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:39890","PortSpecifier":{"PortValue":39890}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.38:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"80f51974-3533-490b-9dc8-60e73bb90c0a","method":"POST","path":"/ai-tenant-e2e-shared-a-c73214/rate-test-model-c73214/v1/completions","host":"e2e-shared-a-c73214.apps.cf8a1ea2-2f33-439b-88a7-aa9ffbf16b67.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-29T15:26:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"80f51974-3533-490b-9dc8-60e73bb90c0a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:39890","PortSpecifier":{"PortValue":39890}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.38:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785338810,"nanos":309605049},"http":{"id":"80f51974-3533-490b-9dc8-60e73bb90c0a","method":"POST","headers":{":authority":"e2e-shared-a-c73214.apps.cf8a1ea2-2f33-439b-88a7-aa9ffbf16b67.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-c73214/rate-test-model-c73214/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T15:26:50Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"80f51974-3533-490b-9dc8-60e73bb90c0a","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-LXI8ZABjQ8BKj5wh_nMltf2fwVISsYwQq3rCeOfpGGTHLXMcZLdWmemnDaF"}
{"level":"debug","ts":"2026-07-29T15:26:50Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"80f51974-3533-490b-9dc8-60e73bb90c0a","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-c73214.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-LXI8ZABjQ8BKj5wh_nMltf2fwVISsYwQq3rCeOfpGGTHLXMcZLdWmemnDaF\"}"}
{"level":"debug","ts":"2026-07-29T15:26:50Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"80f51974-3533-490b-9dc8-60e73bb90c0a","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-c73214.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"4e1ae7c5-b4da-43bb-8b50-837119224226","keyName":"e2e-rate-a-9eaa69","subscription":"e2e-rate-iso-a-9eaa69","tenant":"e2e-shared-a-c73214","userId":"4e1ae7c5-b4da-43bb-8b50-837119224226","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-29T15:26:50Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"80f51974-3533-490b-9dc8-60e73bb90c0a","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-c73214.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-c73214/rate-test-model-c73214\",\"requestedSubscription\":\"e2e-rate-iso-a-9eaa69\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-29T15:26:50Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"80f51974-3533-490b-9dc8-60e73bb90c0a","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-c73214.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-c73214/models/facebook/opt-125m","name":"rate-test-model-c73214","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-9eaa69","namespace":"ai-tenant-e2e-shared-a-c73214","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-c73214/rate-test-model-c73214"}}
{"level":"debug","ts":"2026-07-29T15:26:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"80f51974-3533-490b-9dc8-60e73bb90c0a","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T15:26:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"80f51974-3533-490b-9dc8-60e73bb90c0a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T15:26:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"80f51974-3533-490b-9dc8-60e73bb90c0a","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T15:26:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"80f51974-3533-490b-9dc8-60e73bb90c0a","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T15:26:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"80f51974-3533-490b-9dc8-60e73bb90c0a","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-c73214/rate-test-model-c73214\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-c73214/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T15:26:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"80f51974-3533-490b-9dc8-60e73bb90c0a","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-29T15:26:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"80f51974-3533-490b-9dc8-60e73bb90c0a","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-29T15:26:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"80f51974-3533-490b-9dc8-60e73bb90c0a","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-9eaa69"}
{"level":"debug","ts":"2026-07-29T15:26:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"80f51974-3533-490b-9dc8-60e73bb90c0a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"4e1ae7c5-b4da-43bb-8b50-837119224226","keyName":"e2e-rate-a-9eaa69","selected_subscription":"e2e-rate-iso-a-9eaa69","selected_subscription_key":"ai-tenant-e2e-shared-a-c73214/e2e-rate-iso-a-9eaa69@ai-tenant-e2e-shared-a-c73214/rate-test-model-c73214","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-c73214/models/facebook/opt-125m","name":"rate-test-model-c73214","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-9eaa69","namespace":"ai-tenant-e2e-shared-a-c73214","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-c73214/rate-test-model-c73214"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-29T15:26:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"80f51974-3533-490b-9dc8-60e73bb90c0a","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-29T15:26:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"80f51974-3533-490b-9dc8-60e73bb90c0a","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-29T15:26:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"be6681b7-f730-434f-bc5a-ff860bbbd068","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:39904","PortSpecifier":{"PortValue":39904}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.38:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"be6681b7-f730-434f-bc5a-ff860bbbd068","method":"POST","path":"/ai-tenant-e2e-shared-a-c73214/rate-test-model-c73214/v1/completions","host":"e2e-shared-a-c73214.apps.cf8a1ea2-2f33-439b-88a7-aa9ffbf16b67.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-29T15:26:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"be6681b7-f730-434f-bc5a-ff860bbbd068","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:39904","PortSpecifier":{"PortValue":39904}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.38:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785338811,"nanos":355685066},"http":{"id":"be6681b7-f730-434f-bc5a-ff860bbbd068","method":"POST","headers":{":authority":"e2e-shared-a-c73214.apps.cf8a1ea2-2f33-439b-88a7-aa9ffbf16b67.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-c73214/rate-test-model-c73214/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T15:26:51Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"be6681b7-f730-434f-bc5a-ff860bbbd068","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-LXI8ZABjQ8BKj5wh_nMltf2fwVISsYwQq3rCeOfpGGTHLXMcZLdWmemnDaF"}
{"level":"debug","ts":"2026-07-29T15:26:51Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"be6681b7-f730-434f-bc5a-ff860bbbd068","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-c73214.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-LXI8ZABjQ8BKj5wh_nMltf2fwVISsYwQq3rCeOfpGGTHLXMcZLdWmemnDaF\"}"}
{"level":"debug","ts":"2026-07-29T15:26:51Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"be6681b7-f730-434f-bc5a-ff860bbbd068","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-c73214.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"4e1ae7c5-b4da-43bb-8b50-837119224226","keyName":"e2e-rate-a-9eaa69","subscription":"e2e-rate-iso-a-9eaa69","tenant":"e2e-shared-a-c73214","userId":"4e1ae7c5-b4da-43bb-8b50-837119224226","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-29T15:26:51Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"be6681b7-f730-434f-bc5a-ff860bbbd068","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-c73214.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-c73214/rate-test-model-c73214\",\"requestedSubscription\":\"e2e-rate-iso-a-9eaa69\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-29T15:26:51Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"be6681b7-f730-434f-bc5a-ff860bbbd068","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-c73214.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-c73214/models/facebook/opt-125m","name":"rate-test-model-c73214","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-9eaa69","namespace":"ai-tenant-e2e-shared-a-c73214","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-c73214/rate-test-model-c73214"}}
{"level":"debug","ts":"2026-07-29T15:26:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"be6681b7-f730-434f-bc5a-ff860bbbd068","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T15:26:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"be6681b7-f730-434f-bc5a-ff860bbbd068","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T15:26:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"be6681b7-f730-434f-bc5a-ff860bbbd068","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T15:26:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"be6681b7-f730-434f-bc5a-ff860bbbd068","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T15:26:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"be6681b7-f730-434f-bc5a-ff860bbbd068","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-c73214/rate-test-model-c73214\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-c73214/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T15:26:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"be6681b7-f730-434f-bc5a-ff860bbbd068","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-29T15:26:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"be6681b7-f730-434f-bc5a-ff860bbbd068","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-9eaa69"}
{"level":"debug","ts":"2026-07-29T15:26:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"be6681b7-f730-434f-bc5a-ff860bbbd068","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-29T15:26:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"be6681b7-f730-434f-bc5a-ff860bbbd068","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"4e1ae7c5-b4da-43bb-8b50-837119224226","keyName":"e2e-rate-a-9eaa69","selected_subscription":"e2e-rate-iso-a-9eaa69","selected_subscription_key":"ai-tenant-e2e-shared-a-c73214/e2e-rate-iso-a-9eaa69@ai-tenant-e2e-shared-a-c73214/rate-test-model-c73214","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-c73214/models/facebook/opt-125m","name":"rate-test-model-c73214","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-9eaa69","namespace":"ai-tenant-e2e-shared-a-c73214","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-c73214/rate-test-model-c73214"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-29T15:26:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"be6681b7-f730-434f-bc5a-ff860bbbd068","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-29T15:26:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"be6681b7-f730-434f-bc5a-ff860bbbd068","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-29T15:26:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a45e6136-bfec-41bf-a991-a972666795f2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:39916","PortSpecifier":{"PortValue":39916}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.38:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a45e6136-bfec-41bf-a991-a972666795f2","method":"POST","path":"/ai-tenant-e2e-shared-a-c73214/rate-test-model-c73214/v1/completions","host":"e2e-shared-a-c73214.apps.cf8a1ea2-2f33-439b-88a7-aa9ffbf16b67.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-29T15:26:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a45e6136-bfec-41bf-a991-a972666795f2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:39916","PortSpecifier":{"PortValue":39916}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.38:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785338812,"nanos":396993963},"http":{"id":"a45e6136-bfec-41bf-a991-a972666795f2","method":"POST","headers":{":authority":"e2e-shared-a-c73214.apps.cf8a1ea2-2f33-439b-88a7-aa9ffbf16b67.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-c73214/rate-test-model-c73214/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T15:26:52Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a45e6136-bfec-41bf-a991-a972666795f2","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-LXI8ZABjQ8BKj5wh_nMltf2fwVISsYwQq3rCeOfpGGTHLXMcZLdWmemnDaF"}
{"level":"debug","ts":"2026-07-29T15:26:52Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a45e6136-bfec-41bf-a991-a972666795f2","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-c73214.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-LXI8ZABjQ8BKj5wh_nMltf2fwVISsYwQq3rCeOfpGGTHLXMcZLdWmemnDaF\"}"}
{"level":"debug","ts":"2026-07-29T15:26:52Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a45e6136-bfec-41bf-a991-a972666795f2","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-c73214.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"4e1ae7c5-b4da-43bb-8b50-837119224226","keyName":"e2e-rate-a-9eaa69","subscription":"e2e-rate-iso-a-9eaa69","tenant":"e2e-shared-a-c73214","userId":"4e1ae7c5-b4da-43bb-8b50-837119224226","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-29T15:26:52Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a45e6136-bfec-41bf-a991-a972666795f2","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-c73214.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-c73214/rate-test-model-c73214\",\"requestedSubscription\":\"e2e-rate-iso-a-9eaa69\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-29T15:26:52Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a45e6136-bfec-41bf-a991-a972666795f2","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-c73214.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-c73214/models/facebook/opt-125m","name":"rate-test-model-c73214","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-9eaa69","namespace":"ai-tenant-e2e-shared-a-c73214","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-c73214/rate-test-model-c73214"}}
{"level":"debug","ts":"2026-07-29T15:26:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a45e6136-bfec-41bf-a991-a972666795f2","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T15:26:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a45e6136-bfec-41bf-a991-a972666795f2","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T15:26:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a45e6136-bfec-41bf-a991-a972666795f2","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T15:26:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a45e6136-bfec-41bf-a991-a972666795f2","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T15:26:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a45e6136-bfec-41bf-a991-a972666795f2","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-c73214/rate-test-model-c73214\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-c73214/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T15:26:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a45e6136-bfec-41bf-a991-a972666795f2","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-29T15:26:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a45e6136-bfec-41bf-a991-a972666795f2","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-29T15:26:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a45e6136-bfec-41bf-a991-a972666795f2","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-9eaa69"}
{"level":"debug","ts":"2026-07-29T15:26:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a45e6136-bfec-41bf-a991-a972666795f2","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"4e1ae7c5-b4da-43bb-8b50-837119224226","keyName":"e2e-rate-a-9eaa69","selected_subscription":"e2e-rate-iso-a-9eaa69","selected_subscription_key":"ai-tenant-e2e-shared-a-c73214/e2e-rate-iso-a-9eaa69@ai-tenant-e2e-shared-a-c73214/rate-test-model-c73214","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-c73214/models/facebook/opt-125m","name":"rate-test-model-c73214","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-9eaa69","namespace":"ai-tenant-e2e-shared-a-c73214","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-c73214/rate-test-model-c73214"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-29T15:26:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a45e6136-bfec-41bf-a991-a972666795f2","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-29T15:26:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a45e6136-bfec-41bf-a991-a972666795f2","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-29T15:26:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3f83d31b-5fa8-43c3-8565-523a9289251d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:43288","PortSpecifier":{"PortValue":43288}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.70:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3f83d31b-5fa8-43c3-8565-523a9289251d","method":"POST","path":"/ai-tenant-e2e-shared-b-93e799/rate-test-model-93e799/v1/completions","host":"e2e-shared-b-93e799.apps.cf8a1ea2-2f33-439b-88a7-aa9ffbf16b67.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-29T15:26:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3f83d31b-5fa8-43c3-8565-523a9289251d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:43288","PortSpecifier":{"PortValue":43288}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.70:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785338812,"nanos":434440235},"http":{"id":"3f83d31b-5fa8-43c3-8565-523a9289251d","method":"POST","headers":{":authority":"e2e-shared-b-93e799.apps.cf8a1ea2-2f33-439b-88a7-aa9ffbf16b67.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-93e799/rate-test-model-93e799/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T15:26:52Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3f83d31b-5fa8-43c3-8565-523a9289251d","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-gXtPD2tpGhdrXSOQ_gkAtXHMPtWs2mWfkXq9n7RCOPRTRSPaqxzCN7Rgjsj9"}
{"level":"debug","ts":"2026-07-29T15:26:52Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3f83d31b-5fa8-43c3-8565-523a9289251d","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-93e799.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-gXtPD2tpGhdrXSOQ_gkAtXHMPtWs2mWfkXq9n7RCOPRTRSPaqxzCN7Rgjsj9\"}"}
{"level":"debug","ts":"2026-07-29T15:26:52Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3f83d31b-5fa8-43c3-8565-523a9289251d","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-93e799.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"ee83517b-d276-4a39-8088-3a9a00139b00","keyName":"e2e-rate-b-9eaa69","subscription":"e2e-rate-iso-b-9eaa69","tenant":"e2e-shared-b-93e799","userId":"ee83517b-d276-4a39-8088-3a9a00139b00","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-29T15:26:52Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3f83d31b-5fa8-43c3-8565-523a9289251d","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-93e799.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-93e799/rate-test-model-93e799\",\"requestedSubscription\":\"e2e-rate-iso-b-9eaa69\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-29T15:26:52Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3f83d31b-5fa8-43c3-8565-523a9289251d","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-93e799.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-b-93e799/models/facebook/opt-125m","name":"rate-test-model-93e799","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-9eaa69","namespace":"ai-tenant-e2e-shared-b-93e799","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-b-93e799/rate-test-model-93e799"}}
{"level":"debug","ts":"2026-07-29T15:26:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3f83d31b-5fa8-43c3-8565-523a9289251d","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T15:26:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3f83d31b-5fa8-43c3-8565-523a9289251d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T15:26:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3f83d31b-5fa8-43c3-8565-523a9289251d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T15:26:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3f83d31b-5fa8-43c3-8565-523a9289251d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-93e799/rate-test-model-93e799\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-93e799/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T15:26:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3f83d31b-5fa8-43c3-8565-523a9289251d","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T15:26:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3f83d31b-5fa8-43c3-8565-523a9289251d","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-29T15:26:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3f83d31b-5fa8-43c3-8565-523a9289251d","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-9eaa69"}
{"level":"debug","ts":"2026-07-29T15:26:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3f83d31b-5fa8-43c3-8565-523a9289251d","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-29T15:26:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3f83d31b-5fa8-43c3-8565-523a9289251d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"ee83517b-d276-4a39-8088-3a9a00139b00","keyName":"e2e-rate-b-9eaa69","selected_subscription":"e2e-rate-iso-b-9eaa69","selected_subscription_key":"ai-tenant-e2e-shared-b-93e799/e2e-rate-iso-b-9eaa69@ai-tenant-e2e-shared-b-93e799/rate-test-model-93e799","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-b-93e799/models/facebook/opt-125m","name":"rate-test-model-93e799","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-9eaa69","namespace":"ai-tenant-e2e-shared-b-93e799","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-b-93e799/rate-test-model-93e799"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-29T15:26:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3f83d31b-5fa8-43c3-8565-523a9289251d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-29T15:26:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3f83d31b-5fa8-43c3-8565-523a9289251d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-29T15:26:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6d0ee87d05d145ef268e0eaa4aaeb435e057f59a2e3d3ab9b3de9dcb4dc21bb4"}
{"level":"info","ts":"2026-07-29T15:26:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9b6d1c0cab5a79c1ad8e3edcf287955199014f39bea63f0595670f370c4d0f13"}
{"level":"info","ts":"2026-07-29T15:26:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6c29f3c41e47464fdd57fb502650c71c9824454e118b4643385c2b67f8be65c4"}
{"level":"info","ts":"2026-07-29T15:26:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c4f83a2b50f844778d63ea5e4704a54ccd8ff6bf7fdc2f93eb1708f3c029a203"}
{"level":"info","ts":"2026-07-29T15:26:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b3e85335a6b0e5c36a58a7c5baf143b4301e88f9c842cbcbb35f607043506fd1"}
{"level":"info","ts":"2026-07-29T15:26:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b26a9417cbf0a79b8ca790fdb55ada7f9008dc435e25ee3be0c66cd3481b63dd"}
{"level":"info","ts":"2026-07-29T15:26:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c8e26bab014f2fcc1316f8995b37aee43dd9a1b8e3b25566a69236dd618a784c"}
{"level":"info","ts":"2026-07-29T15:26:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3cc6d08616dc4681221a4d92d662450a8bdcece9522de55b84eeb58edd43c06c"}
{"level":"info","ts":"2026-07-29T15:26:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3e0440d31e7c0454c0ebf525fbe6e514fd42c5fbb2867ec47f6ed6ebce285576"}
{"level":"info","ts":"2026-07-29T15:26:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/593899283a26ef186fe81e09eb90ae3236a988b58aedd2e9c40fb22a22ff5673"}
{"level":"info","ts":"2026-07-29T15:26:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3169a5d7b2fa79651965464d4b4ab3f80d52066b8d4e2540c6e298c47e9d131e"}
{"level":"info","ts":"2026-07-29T15:26:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b32a81609c636a6c92631dbe333ba978ed75a044b1bc695317d051890c5f8524"}
{"level":"info","ts":"2026-07-29T15:26:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/dfc2c1ce9f34a0037d2d03447e873469c5614cc2139c0211779c75e5a59aacdd"}
{"level":"info","ts":"2026-07-29T15:26:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3461ace12e159a70fa4200464febf41328430d9e3612cfe6ecc6ba10a7f87aa3"}
{"level":"info","ts":"2026-07-29T15:26:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4acb26c38cdce21eef64a39ab3963536cdf9dea174626c09c3ecbe6fa283cf2e"}
{"level":"info","ts":"2026-07-29T15:26:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/cf68e2d91a58dcc217051e24077562d0237240703e118d34bf5b5e7e83fd3285"}
{"level":"info","ts":"2026-07-29T15:26:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/692072ee5e6244029dd7e24ece56d6dae76b9e52d2bf1c472eee1f2f24432647"}
{"level":"info","ts":"2026-07-29T15:26:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/5d918de450c07b0cf9f6be55a9a3c246f5f4e173451c5c9ec93791f6dd88942b"}
{"level":"info","ts":"2026-07-29T15:26:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2a581377f8abe316ea61592562cd4f524509bb0e3afb7c398a9d869f9ae503ac"}
{"level":"info","ts":"2026-07-29T15:26:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7669bf60085a044116eb16c9c7b9dca24c446e0a2c32303a9a22e7b3c7f4a308"}
{"level":"info","ts":"2026-07-29T15:26:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3209e94184d0c70ecf8f53de96df64a78999e74a1e57c7d26d61e7277976e687"}
{"level":"info","ts":"2026-07-29T15:26:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/cd7afeb458d40858b95950d91f9b052e80233449b1e819b5025fb9ad1c1cf99b"}
{"level":"info","ts":"2026-07-29T15:26:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/97d287eb79c0424d50b0e4cd556ecd88b88f41be0af99ed9290bdd1da3db177c"}
{"level":"info","ts":"2026-07-29T15:26:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7b2eef324e729eb41dd12afa886686f491f9eee8e64def11d9717be7491df35f"}
{"level":"info","ts":"2026-07-29T15:28:16Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6f92d534-4462-4e83-9874-8a13a11e9812","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:49500","PortSpecifier":{"PortValue":49500}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.25:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6f92d534-4462-4e83-9874-8a13a11e9812","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.cf8a1ea2-2f33-439b-88a7-aa9ffbf16b67.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-29T15:28:16Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6f92d534-4462-4e83-9874-8a13a11e9812","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:49500","PortSpecifier":{"PortValue":49500}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.25:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785338896,"nanos":48064349},"http":{"id":"6f92d534-4462-4e83-9874-8a13a11e9812","method":"POST","headers":{":authority":"maas.apps.cf8a1ea2-2f33-439b-88a7-aa9ffbf16b67.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T15:28:16Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"6f92d534-4462-4e83-9874-8a13a11e9812","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-29T15:28:16Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6f92d534-4462-4e83-9874-8a13a11e9812","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"3ea24739-528b-4fc8-922d-d3e64a5d5dc1","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4e41eb26-42ce-4777-9f69-a28d16cdabc6"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/aa9ffbf16b67"]}}
{"level":"debug","ts":"2026-07-29T15:28:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6f92d534-4462-4e83-9874-8a13a11e9812","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/aa9ffbf16b67"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4e41eb26-42ce-4777-9f69-a28d16cdabc6"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"3ea24739-528b-4fc8-922d-d3e64a5d5dc1","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.25:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.cf8a1ea2-2f33-439b-88a7-aa9ffbf16b67.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T15:28:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6f92d534-4462-4e83-9874-8a13a11e9812","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T15:28:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6f92d534-4462-4e83-9874-8a13a11e9812","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T15:28:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6f92d534-4462-4e83-9874-8a13a11e9812","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]},\"publishers/llm/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/llm/models/facebook/opt-125m-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T15:28:16Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"6f92d534-4462-4e83-9874-8a13a11e9812","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-29T15:28:16Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6f92d534-4462-4e83-9874-8a13a11e9812","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-29T15:28:16Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6f92d534-4462-4e83-9874-8a13a11e9812","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-29T15:28:16Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6f92d534-4462-4e83-9874-8a13a11e9812","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-29T15:28:16Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6f92d534-4462-4e83-9874-8a13a11e9812","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-29T15:28:16Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1a533d99-e7aa-4424-94fa-c62046fb917c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:49512","PortSpecifier":{"PortValue":49512}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.25:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1a533d99-e7aa-4424-94fa-c62046fb917c","method":"POST","path":"/llm/facebook-opt-125m-simulated/v1/chat/completions","host":"maas.apps.cf8a1ea2-2f33-439b-88a7-aa9ffbf16b67.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-29T15:28:16Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1a533d99-e7aa-4424-94fa-c62046fb917c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:49512","PortSpecifier":{"PortValue":49512}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.25:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785338896,"nanos":100901312},"http":{"id":"1a533d99-e7aa-4424-94fa-c62046fb917c","method":"POST","headers":{":authority":"maas.apps.cf8a1ea2-2f33-439b-88a7-aa9ffbf16b67.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T15:28:16Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1a533d99-e7aa-4424-94fa-c62046fb917c","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-n3pyu6y83joSIirx_sTh9zXn5XWc4DP1BTLfNDeIawKql9CZUJPJ82gwyG6W"}
{"level":"debug","ts":"2026-07-29T15:28:16Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1a533d99-e7aa-4424-94fa-c62046fb917c","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-n3pyu6y83joSIirx_sTh9zXn5XWc4DP1BTLfNDeIawKql9CZUJPJ82gwyG6W\"}"}
{"level":"debug","ts":"2026-07-29T15:28:16Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1a533d99-e7aa-4424-94fa-c62046fb917c","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"b88fb457-1e9d-4758-9ef9-eed1afe071f0","keyName":"e2e-ipp-default","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"b88fb457-1e9d-4758-9ef9-eed1afe071f0","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-29T15:28:16Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1a533d99-e7aa-4424-94fa-c62046fb917c","config":"subscription-info","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"simulator-subscription\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-29T15:28:16Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1a533d99-e7aa-4424-94fa-c62046fb917c","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","model_name":"publishers/llm/models/facebook/opt-125m","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true,"resolvedModel":"llm/facebook-opt-125m-simulated"}}
{"level":"debug","ts":"2026-07-29T15:28:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1a533d99-e7aa-4424-94fa-c62046fb917c","input":{"auth":{"identity":"Bearer **** subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","model_name":"publishers/llm/models/facebook/opt-125m","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true,"resolvedModel":"llm/facebook-opt-125m-simulated"}}},"context":{"context_extensions":{"host":"311b1be286674fd5684c9ac59b318287dade9769cfe4aeebd8c88e2dc6b72418"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.25:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.cf8a1ea2-2f33-439b-88a7-aa9ffbf16b67.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T15:28:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1a533d99-e7aa-4424-94fa-c62046fb917c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T15:28:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1a533d99-e7aa-4424-94fa-c62046fb917c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T15:28:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1a533d99-e7aa-4424-94fa-c62046fb917c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]},\"publishers/llm/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/llm/models/facebook/opt-125m-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T15:28:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1a533d99-e7aa-4424-94fa-c62046fb917c","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T15:28:16Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1a533d99-e7aa-4424-94fa-c62046fb917c","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-29T15:28:16Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1a533d99-e7aa-4424-94fa-c62046fb917c","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-29T15:28:16Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1a533d99-e7aa-4424-94fa-c62046fb917c","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-29T15:28:16Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1a533d99-e7aa-4424-94fa-c62046fb917c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"b88fb457-1e9d-4758-9ef9-eed1afe071f0","keyName":"e2e-ipp-default","selected_subscription":"simulator-subscription","selected_subscription_key":"models-as-a-service/simulator-subscription@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","model_name":"publishers/llm/models/facebook/opt-125m","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true,"resolvedModel":"llm/facebook-opt-125m-simulated"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-29T15:28:16Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1a533d99-e7aa-4424-94fa-c62046fb917c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-29T15:28:16Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1a533d99-e7aa-4424-94fa-c62046fb917c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-29T15:28:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f068e058f107ee9744804a6eecef1dcbee6932fb3543d76dd479693e8a9b231b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T15:28:43Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T15:28:43Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T15:28:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f068e058f107ee9744804a6eecef1dcbee6932fb3543d76dd479693e8a9b231b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T15:28:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f068e058f107ee9744804a6eecef1dcbee6932fb3543d76dd479693e8a9b231b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T15:28:43Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T15:28:43Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T15:28:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f068e058f107ee9744804a6eecef1dcbee6932fb3543d76dd479693e8a9b231b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T15:28:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f068e058f107ee9744804a6eecef1dcbee6932fb3543d76dd479693e8a9b231b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T15:28:43Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T15:28:43Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T15:28:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f068e058f107ee9744804a6eecef1dcbee6932fb3543d76dd479693e8a9b231b"}
{"level":"error","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"f068e058f107ee9744804a6eecef1dcbee6932fb3543d76dd479693e8a9b231b","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"f068e058f107ee9744804a6eecef1dcbee6932fb3543d76dd479693e8a9b231b\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f068e058f107ee9744804a6eecef1dcbee6932fb3543d76dd479693e8a9b231b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f068e058f107ee9744804a6eecef1dcbee6932fb3543d76dd479693e8a9b231b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f068e058f107ee9744804a6eecef1dcbee6932fb3543d76dd479693e8a9b231b"}
{"level":"debug","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c46b6cae1d6a335f3fb757dfb0f808e2d2168c5e5258077c7852ea6865410d5f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T15:28:44Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T15:28:44Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c46b6cae1d6a335f3fb757dfb0f808e2d2168c5e5258077c7852ea6865410d5f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c46b6cae1d6a335f3fb757dfb0f808e2d2168c5e5258077c7852ea6865410d5f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T15:28:44Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T15:28:44Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c46b6cae1d6a335f3fb757dfb0f808e2d2168c5e5258077c7852ea6865410d5f"}
{"level":"info","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c46b6cae1d6a335f3fb757dfb0f808e2d2168c5e5258077c7852ea6865410d5f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f068e058f107ee9744804a6eecef1dcbee6932fb3543d76dd479693e8a9b231b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T15:28:44Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T15:28:44Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["f068e058f107ee9744804a6eecef1dcbee6932fb3543d76dd479693e8a9b231b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f068e058f107ee9744804a6eecef1dcbee6932fb3543d76dd479693e8a9b231b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c46b6cae1d6a335f3fb757dfb0f808e2d2168c5e5258077c7852ea6865410d5f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c46b6cae1d6a335f3fb757dfb0f808e2d2168c5e5258077c7852ea6865410d5f"}
{"level":"debug","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f068e058f107ee9744804a6eecef1dcbee6932fb3543d76dd479693e8a9b231b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c46b6cae1d6a335f3fb757dfb0f808e2d2168c5e5258077c7852ea6865410d5f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c46b6cae1d6a335f3fb757dfb0f808e2d2168c5e5258077c7852ea6865410d5f"}
{"level":"info","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f068e058f107ee9744804a6eecef1dcbee6932fb3543d76dd479693e8a9b231b"}
{"level":"debug","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c46b6cae1d6a335f3fb757dfb0f808e2d2168c5e5258077c7852ea6865410d5f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T15:28:44Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T15:28:44Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c46b6cae1d6a335f3fb757dfb0f808e2d2168c5e5258077c7852ea6865410d5f"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c46b6cae1d6a335f3fb757dfb0f808e2d2168c5e5258077c7852ea6865410d5f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c46b6cae1d6a335f3fb757dfb0f808e2d2168c5e5258077c7852ea6865410d5f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T15:28:44Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T15:28:44Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c46b6cae1d6a335f3fb757dfb0f808e2d2168c5e5258077c7852ea6865410d5f"}
{"level":"info","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c46b6cae1d6a335f3fb757dfb0f808e2d2168c5e5258077c7852ea6865410d5f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c46b6cae1d6a335f3fb757dfb0f808e2d2168c5e5258077c7852ea6865410d5f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c46b6cae1d6a335f3fb757dfb0f808e2d2168c5e5258077c7852ea6865410d5f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c46b6cae1d6a335f3fb757dfb0f808e2d2168c5e5258077c7852ea6865410d5f"}
{"level":"debug","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c46b6cae1d6a335f3fb757dfb0f808e2d2168c5e5258077c7852ea6865410d5f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T15:28:44Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T15:28:44Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c46b6cae1d6a335f3fb757dfb0f808e2d2168c5e5258077c7852ea6865410d5f"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c46b6cae1d6a335f3fb757dfb0f808e2d2168c5e5258077c7852ea6865410d5f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9bef10e1543434ab9bdac9e478450aa31f34e05807ec0bda60456ef279083b19","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T15:28:44Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T15:28:44Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9bef10e1543434ab9bdac9e478450aa31f34e05807ec0bda60456ef279083b19","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c46b6cae1d6a335f3fb757dfb0f808e2d2168c5e5258077c7852ea6865410d5f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9bef10e1543434ab9bdac9e478450aa31f34e05807ec0bda60456ef279083b19","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9bef10e1543434ab9bdac9e478450aa31f34e05807ec0bda60456ef279083b19"}
{"level":"debug","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9bef10e1543434ab9bdac9e478450aa31f34e05807ec0bda60456ef279083b19","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T15:28:44Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T15:28:44Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9bef10e1543434ab9bdac9e478450aa31f34e05807ec0bda60456ef279083b19"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9bef10e1543434ab9bdac9e478450aa31f34e05807ec0bda60456ef279083b19","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9bef10e1543434ab9bdac9e478450aa31f34e05807ec0bda60456ef279083b19","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c46b6cae1d6a335f3fb757dfb0f808e2d2168c5e5258077c7852ea6865410d5f"}
{"level":"info","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9bef10e1543434ab9bdac9e478450aa31f34e05807ec0bda60456ef279083b19"}
{"level":"debug","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dd66d9be83306e8e2dce482be5a9e0d8c9e25fefbcff5a5f2e038f5d89e392ba","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T15:28:44Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T15:28:44Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dd66d9be83306e8e2dce482be5a9e0d8c9e25fefbcff5a5f2e038f5d89e392ba","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dd66d9be83306e8e2dce482be5a9e0d8c9e25fefbcff5a5f2e038f5d89e392ba","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dd66d9be83306e8e2dce482be5a9e0d8c9e25fefbcff5a5f2e038f5d89e392ba","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dd66d9be83306e8e2dce482be5a9e0d8c9e25fefbcff5a5f2e038f5d89e392ba"}
{"level":"debug","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dd66d9be83306e8e2dce482be5a9e0d8c9e25fefbcff5a5f2e038f5d89e392ba","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dd66d9be83306e8e2dce482be5a9e0d8c9e25fefbcff5a5f2e038f5d89e392ba"}
{"level":"debug","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dd66d9be83306e8e2dce482be5a9e0d8c9e25fefbcff5a5f2e038f5d89e392ba","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T15:28:44Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T15:28:44Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["dd66d9be83306e8e2dce482be5a9e0d8c9e25fefbcff5a5f2e038f5d89e392ba"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dd66d9be83306e8e2dce482be5a9e0d8c9e25fefbcff5a5f2e038f5d89e392ba","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dd66d9be83306e8e2dce482be5a9e0d8c9e25fefbcff5a5f2e038f5d89e392ba","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T15:28:44Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T15:28:44Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dd66d9be83306e8e2dce482be5a9e0d8c9e25fefbcff5a5f2e038f5d89e392ba","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e8e963a44db02b40dcb96389fb0b580f0fa7d3cbf612e86a174677f83b2b58d7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T15:28:44Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T15:28:44Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dd66d9be83306e8e2dce482be5a9e0d8c9e25fefbcff5a5f2e038f5d89e392ba"}
{"level":"info","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e8e963a44db02b40dcb96389fb0b580f0fa7d3cbf612e86a174677f83b2b58d7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dd66d9be83306e8e2dce482be5a9e0d8c9e25fefbcff5a5f2e038f5d89e392ba","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T15:28:44Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T15:28:44Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["dd66d9be83306e8e2dce482be5a9e0d8c9e25fefbcff5a5f2e038f5d89e392ba"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dd66d9be83306e8e2dce482be5a9e0d8c9e25fefbcff5a5f2e038f5d89e392ba","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e8e963a44db02b40dcb96389fb0b580f0fa7d3cbf612e86a174677f83b2b58d7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T15:28:44Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T15:28:44Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e8e963a44db02b40dcb96389fb0b580f0fa7d3cbf612e86a174677f83b2b58d7"}
{"level":"info","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e8e963a44db02b40dcb96389fb0b580f0fa7d3cbf612e86a174677f83b2b58d7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dd66d9be83306e8e2dce482be5a9e0d8c9e25fefbcff5a5f2e038f5d89e392ba","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T15:28:44Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T15:28:44Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dd66d9be83306e8e2dce482be5a9e0d8c9e25fefbcff5a5f2e038f5d89e392ba"}
{"level":"info","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dd66d9be83306e8e2dce482be5a9e0d8c9e25fefbcff5a5f2e038f5d89e392ba","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e8e963a44db02b40dcb96389fb0b580f0fa7d3cbf612e86a174677f83b2b58d7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dd66d9be83306e8e2dce482be5a9e0d8c9e25fefbcff5a5f2e038f5d89e392ba","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T15:28:44Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T15:28:44Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["dd66d9be83306e8e2dce482be5a9e0d8c9e25fefbcff5a5f2e038f5d89e392ba"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dd66d9be83306e8e2dce482be5a9e0d8c9e25fefbcff5a5f2e038f5d89e392ba","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dd66d9be83306e8e2dce482be5a9e0d8c9e25fefbcff5a5f2e038f5d89e392ba","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T15:28:44Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T15:28:44Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["dd66d9be83306e8e2dce482be5a9e0d8c9e25fefbcff5a5f2e038f5d89e392ba"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e8e963a44db02b40dcb96389fb0b580f0fa7d3cbf612e86a174677f83b2b58d7"}
{"level":"error","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"dd66d9be83306e8e2dce482be5a9e0d8c9e25fefbcff5a5f2e038f5d89e392ba","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"dd66d9be83306e8e2dce482be5a9e0d8c9e25fefbcff5a5f2e038f5d89e392ba\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dd66d9be83306e8e2dce482be5a9e0d8c9e25fefbcff5a5f2e038f5d89e392ba","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T15:28:44Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T15:28:44Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dd66d9be83306e8e2dce482be5a9e0d8c9e25fefbcff5a5f2e038f5d89e392ba","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e8e963a44db02b40dcb96389fb0b580f0fa7d3cbf612e86a174677f83b2b58d7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T15:28:44Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T15:28:44Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e8e963a44db02b40dcb96389fb0b580f0fa7d3cbf612e86a174677f83b2b58d7"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dd66d9be83306e8e2dce482be5a9e0d8c9e25fefbcff5a5f2e038f5d89e392ba"}
{"level":"info","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e8e963a44db02b40dcb96389fb0b580f0fa7d3cbf612e86a174677f83b2b58d7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dd66d9be83306e8e2dce482be5a9e0d8c9e25fefbcff5a5f2e038f5d89e392ba","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c668aa9a0776367b60d83a9c1a526f1955d51de22eb1a325580a9f424e302b1f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T15:28:44Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T15:28:44Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dd66d9be83306e8e2dce482be5a9e0d8c9e25fefbcff5a5f2e038f5d89e392ba"}
{"level":"info","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c668aa9a0776367b60d83a9c1a526f1955d51de22eb1a325580a9f424e302b1f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e8e963a44db02b40dcb96389fb0b580f0fa7d3cbf612e86a174677f83b2b58d7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c668aa9a0776367b60d83a9c1a526f1955d51de22eb1a325580a9f424e302b1f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T15:28:44Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T15:28:44Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c668aa9a0776367b60d83a9c1a526f1955d51de22eb1a325580a9f424e302b1f"}
{"level":"info","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c668aa9a0776367b60d83a9c1a526f1955d51de22eb1a325580a9f424e302b1f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dd66d9be83306e8e2dce482be5a9e0d8c9e25fefbcff5a5f2e038f5d89e392ba","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T15:28:44Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T15:28:44Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["dd66d9be83306e8e2dce482be5a9e0d8c9e25fefbcff5a5f2e038f5d89e392ba"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dd66d9be83306e8e2dce482be5a9e0d8c9e25fefbcff5a5f2e038f5d89e392ba","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c668aa9a0776367b60d83a9c1a526f1955d51de22eb1a325580a9f424e302b1f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T15:28:44Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T15:28:44Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c668aa9a0776367b60d83a9c1a526f1955d51de22eb1a325580a9f424e302b1f"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e8e963a44db02b40dcb96389fb0b580f0fa7d3cbf612e86a174677f83b2b58d7"}
{"level":"info","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c668aa9a0776367b60d83a9c1a526f1955d51de22eb1a325580a9f424e302b1f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dd66d9be83306e8e2dce482be5a9e0d8c9e25fefbcff5a5f2e038f5d89e392ba","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c668aa9a0776367b60d83a9c1a526f1955d51de22eb1a325580a9f424e302b1f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T15:28:44Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T15:28:44Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c668aa9a0776367b60d83a9c1a526f1955d51de22eb1a325580a9f424e302b1f"}
{"level":"info","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c668aa9a0776367b60d83a9c1a526f1955d51de22eb1a325580a9f424e302b1f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c668aa9a0776367b60d83a9c1a526f1955d51de22eb1a325580a9f424e302b1f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T15:28:44Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T15:28:44Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c668aa9a0776367b60d83a9c1a526f1955d51de22eb1a325580a9f424e302b1f"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c668aa9a0776367b60d83a9c1a526f1955d51de22eb1a325580a9f424e302b1f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c668aa9a0776367b60d83a9c1a526f1955d51de22eb1a325580a9f424e302b1f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T15:28:44Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T15:28:44Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c668aa9a0776367b60d83a9c1a526f1955d51de22eb1a325580a9f424e302b1f"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dd66d9be83306e8e2dce482be5a9e0d8c9e25fefbcff5a5f2e038f5d89e392ba"}
{"level":"error","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"c668aa9a0776367b60d83a9c1a526f1955d51de22eb1a325580a9f424e302b1f","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"c668aa9a0776367b60d83a9c1a526f1955d51de22eb1a325580a9f424e302b1f\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c668aa9a0776367b60d83a9c1a526f1955d51de22eb1a325580a9f424e302b1f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T15:28:44Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T15:28:44Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c668aa9a0776367b60d83a9c1a526f1955d51de22eb1a325580a9f424e302b1f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"60885dc14ec40c96538f6b1359c6e206691664e4432b9afe32cfb98f79176e22","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T15:28:44Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T15:28:44Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c668aa9a0776367b60d83a9c1a526f1955d51de22eb1a325580a9f424e302b1f"}
{"level":"info","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"60885dc14ec40c96538f6b1359c6e206691664e4432b9afe32cfb98f79176e22","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c668aa9a0776367b60d83a9c1a526f1955d51de22eb1a325580a9f424e302b1f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T15:28:44Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T15:28:44Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c668aa9a0776367b60d83a9c1a526f1955d51de22eb1a325580a9f424e302b1f"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/60885dc14ec40c96538f6b1359c6e206691664e4432b9afe32cfb98f79176e22"}
{"level":"info","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c668aa9a0776367b60d83a9c1a526f1955d51de22eb1a325580a9f424e302b1f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"60885dc14ec40c96538f6b1359c6e206691664e4432b9afe32cfb98f79176e22","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T15:28:44Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T15:28:44Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["60885dc14ec40c96538f6b1359c6e206691664e4432b9afe32cfb98f79176e22"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c668aa9a0776367b60d83a9c1a526f1955d51de22eb1a325580a9f424e302b1f"}
{"level":"info","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"60885dc14ec40c96538f6b1359c6e206691664e4432b9afe32cfb98f79176e22","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c668aa9a0776367b60d83a9c1a526f1955d51de22eb1a325580a9f424e302b1f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"60885dc14ec40c96538f6b1359c6e206691664e4432b9afe32cfb98f79176e22","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T15:28:44Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T15:28:44Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"60885dc14ec40c96538f6b1359c6e206691664e4432b9afe32cfb98f79176e22","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"60885dc14ec40c96538f6b1359c6e206691664e4432b9afe32cfb98f79176e22","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/60885dc14ec40c96538f6b1359c6e206691664e4432b9afe32cfb98f79176e22"}
{"level":"debug","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"60885dc14ec40c96538f6b1359c6e206691664e4432b9afe32cfb98f79176e22","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T15:28:44Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T15:28:44Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["60885dc14ec40c96538f6b1359c6e206691664e4432b9afe32cfb98f79176e22"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"60885dc14ec40c96538f6b1359c6e206691664e4432b9afe32cfb98f79176e22","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"60885dc14ec40c96538f6b1359c6e206691664e4432b9afe32cfb98f79176e22","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c668aa9a0776367b60d83a9c1a526f1955d51de22eb1a325580a9f424e302b1f"}
{"level":"debug","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c1cb1a42d8c92339191913c0d7d9254e6076e9df9210b42c495346e593ad6248","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T15:28:44Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T15:28:44Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/60885dc14ec40c96538f6b1359c6e206691664e4432b9afe32cfb98f79176e22"}
{"level":"info","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c1cb1a42d8c92339191913c0d7d9254e6076e9df9210b42c495346e593ad6248","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c1cb1a42d8c92339191913c0d7d9254e6076e9df9210b42c495346e593ad6248","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T15:28:44Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T15:28:44Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c1cb1a42d8c92339191913c0d7d9254e6076e9df9210b42c495346e593ad6248"}
{"level":"info","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c1cb1a42d8c92339191913c0d7d9254e6076e9df9210b42c495346e593ad6248","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c1cb1a42d8c92339191913c0d7d9254e6076e9df9210b42c495346e593ad6248","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c1cb1a42d8c92339191913c0d7d9254e6076e9df9210b42c495346e593ad6248","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c1cb1a42d8c92339191913c0d7d9254e6076e9df9210b42c495346e593ad6248"}
{"level":"debug","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6fb9f9075af3fa51be0a1d505a6a1ffa8999ea0dfff6e5e073c5288fd1de8a5f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T15:28:44Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T15:28:44Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6fb9f9075af3fa51be0a1d505a6a1ffa8999ea0dfff6e5e073c5288fd1de8a5f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c1cb1a42d8c92339191913c0d7d9254e6076e9df9210b42c495346e593ad6248","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c1cb1a42d8c92339191913c0d7d9254e6076e9df9210b42c495346e593ad6248"}
{"level":"debug","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6fb9f9075af3fa51be0a1d505a6a1ffa8999ea0dfff6e5e073c5288fd1de8a5f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T15:28:44Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T15:28:44Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6fb9f9075af3fa51be0a1d505a6a1ffa8999ea0dfff6e5e073c5288fd1de8a5f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6fb9f9075af3fa51be0a1d505a6a1ffa8999ea0dfff6e5e073c5288fd1de8a5f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T15:28:44Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T15:28:44Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"6fb9f9075af3fa51be0a1d505a6a1ffa8999ea0dfff6e5e073c5288fd1de8a5f","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"6fb9f9075af3fa51be0a1d505a6a1ffa8999ea0dfff6e5e073c5288fd1de8a5f\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6fb9f9075af3fa51be0a1d505a6a1ffa8999ea0dfff6e5e073c5288fd1de8a5f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6fb9f9075af3fa51be0a1d505a6a1ffa8999ea0dfff6e5e073c5288fd1de8a5f"}
{"level":"debug","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6fb9f9075af3fa51be0a1d505a6a1ffa8999ea0dfff6e5e073c5288fd1de8a5f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6fb9f9075af3fa51be0a1d505a6a1ffa8999ea0dfff6e5e073c5288fd1de8a5f"}
{"level":"debug","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c1cb1a42d8c92339191913c0d7d9254e6076e9df9210b42c495346e593ad6248","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T15:28:44Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T15:28:44Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c1cb1a42d8c92339191913c0d7d9254e6076e9df9210b42c495346e593ad6248"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c1cb1a42d8c92339191913c0d7d9254e6076e9df9210b42c495346e593ad6248","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1258fb539f19ebe7c8cd860659c2fdfe697644e47ab50e6cddfb5f7c5a2856e4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T15:28:44Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T15:28:44Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1258fb539f19ebe7c8cd860659c2fdfe697644e47ab50e6cddfb5f7c5a2856e4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c1cb1a42d8c92339191913c0d7d9254e6076e9df9210b42c495346e593ad6248","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1258fb539f19ebe7c8cd860659c2fdfe697644e47ab50e6cddfb5f7c5a2856e4"}
{"level":"debug","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f69d6d7e2178fcdae8732cbcccd157325eabd2f6ed7e9487cc436ad6877d8861","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T15:28:44Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T15:28:44Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f69d6d7e2178fcdae8732cbcccd157325eabd2f6ed7e9487cc436ad6877d8861","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T15:28:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6fb9f9075af3fa51be0a1d505a6a1ffa8999ea0dfff6e5e073c5288fd1de8a5f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T15:28:44Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T15:28:44Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["6fb9f9075af3fa51be0a1d505a6a1ffa8999ea0dfff6e5e073c5288fd1de8a5f"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T15:28:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c1cb1a42d8c92339191913c0d7d9254e6076e9df9210b42c495346e593ad6248"}
{"level":"info","ts":"2026-07-29T15:28:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6fb9f9075af3fa51be0a1d505a6a1ffa8999ea0dfff6e5e073c5288fd1de8a5f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T15:28:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1258fb539f19ebe7c8cd860659c2fdfe697644e47ab50e6cddfb5f7c5a2856e4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T15:28:45Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T15:28:45Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1258fb539f19ebe7c8cd860659c2fdfe697644e47ab50e6cddfb5f7c5a2856e4"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T15:28:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1258fb539f19ebe7c8cd860659c2fdfe697644e47ab50e6cddfb5f7c5a2856e4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T15:28:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f1ba0256b23873321ef8118b293c1e291c033446ec685731cddc7fb85e4633b4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T15:28:45Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T15:28:45Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T15:28:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f69d6d7e2178fcdae8732cbcccd157325eabd2f6ed7e9487cc436ad6877d8861"}
{"level":"info","ts":"2026-07-29T15:28:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f1ba0256b23873321ef8118b293c1e291c033446ec685731cddc7fb85e4633b4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T15:28:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f69d6d7e2178fcdae8732cbcccd157325eabd2f6ed7e9487cc436ad6877d8861","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T15:28:45Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T15:28:45Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["f69d6d7e2178fcdae8732cbcccd157325eabd2f6ed7e9487cc436ad6877d8861"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T15:28:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1258fb539f19ebe7c8cd860659c2fdfe697644e47ab50e6cddfb5f7c5a2856e4"}
{"level":"info","ts":"2026-07-29T15:28:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f69d6d7e2178fcdae8732cbcccd157325eabd2f6ed7e9487cc436ad6877d8861","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T15:28:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6fb9f9075af3fa51be0a1d505a6a1ffa8999ea0dfff6e5e073c5288fd1de8a5f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T15:28:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1258fb539f19ebe7c8cd860659c2fdfe697644e47ab50e6cddfb5f7c5a2856e4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T15:28:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f1ba0256b23873321ef8118b293c1e291c033446ec685731cddc7fb85e4633b4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T15:28:45Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T15:28:45Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T15:28:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f1ba0256b23873321ef8118b293c1e291c033446ec685731cddc7fb85e4633b4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T15:28:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f69d6d7e2178fcdae8732cbcccd157325eabd2f6ed7e9487cc436ad6877d8861","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T15:28:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f1ba0256b23873321ef8118b293c1e291c033446ec685731cddc7fb85e4633b4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-29T15:28:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f1ba0256b23873321ef8118b293c1e291c033446ec685731cddc7fb85e4633b4"}
{"level":"debug","ts":"2026-07-29T15:28:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f1ba0256b23873321ef8118b293c1e291c033446ec685731cddc7fb85e4633b4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T15:28:45Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T15:28:45Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["f1ba0256b23873321ef8118b293c1e291c033446ec685731cddc7fb85e4633b4"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T15:28:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f1ba0256b23873321ef8118b293c1e291c033446ec685731cddc7fb85e4633b4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T15:28:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f1ba0256b23873321ef8118b293c1e291c033446ec685731cddc7fb85e4633b4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-29T15:28:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6fb9f9075af3fa51be0a1d505a6a1ffa8999ea0dfff6e5e073c5288fd1de8a5f"}
{"level":"info","ts":"2026-07-29T15:28:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f69d6d7e2178fcdae8732cbcccd157325eabd2f6ed7e9487cc436ad6877d8861"}
{"level":"info","ts":"2026-07-29T15:28:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f1ba0256b23873321ef8118b293c1e291c033446ec685731cddc7fb85e4633b4"}
{"level":"info","ts":"2026-07-29T15:29:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7f9373ec-ea5b-422c-b355-6ddcfeff9683","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:36264","PortSpecifier":{"PortValue":36264}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.73:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"7f9373ec-ea5b-422c-b355-6ddcfeff9683","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-ipp-a-3261e1.apps.cf8a1ea2-2f33-439b-88a7-aa9ffbf16b67.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-29T15:29:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7f9373ec-ea5b-422c-b355-6ddcfeff9683","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:36264","PortSpecifier":{"PortValue":36264}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.73:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785338944,"nanos":169717714},"http":{"id":"7f9373ec-ea5b-422c-b355-6ddcfeff9683","method":"POST","headers":{":authority":"e2e-ipp-a-3261e1.apps.cf8a1ea2-2f33-439b-88a7-aa9ffbf16b67.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T15:29:04Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"7f9373ec-ea5b-422c-b355-6ddcfeff9683","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-29T15:29:04Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"7f9373ec-ea5b-422c-b355-6ddcfeff9683","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"3ea24739-528b-4fc8-922d-d3e64a5d5dc1","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4e41eb26-42ce-4777-9f69-a28d16cdabc6"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/aa9ffbf16b67"]}}
{"level":"debug","ts":"2026-07-29T15:29:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"7f9373ec-ea5b-422c-b355-6ddcfeff9683","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/aa9ffbf16b67"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4e41eb26-42ce-4777-9f69-a28d16cdabc6"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"3ea24739-528b-4fc8-922d-d3e64a5d5dc1","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"60885dc14ec40c96538f6b1359c6e206691664e4432b9afe32cfb98f79176e22"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.73:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-ipp-a-3261e1.apps.cf8a1ea2-2f33-439b-88a7-aa9ffbf16b67.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T15:29:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7f9373ec-ea5b-422c-b355-6ddcfeff9683","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T15:29:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7f9373ec-ea5b-422c-b355-6ddcfeff9683","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T15:29:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7f9373ec-ea5b-422c-b355-6ddcfeff9683","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-ipp-a-3261e1/ipp-route-3261e1\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-ipp-a-3261e1/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T15:29:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"7f9373ec-ea5b-422c-b355-6ddcfeff9683","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-29T15:29:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7f9373ec-ea5b-422c-b355-6ddcfeff9683","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-29T15:29:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7f9373ec-ea5b-422c-b355-6ddcfeff9683","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-29T15:29:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7f9373ec-ea5b-422c-b355-6ddcfeff9683","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-29T15:29:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7f9373ec-ea5b-422c-b355-6ddcfeff9683","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-29T15:29:06Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"59c8c952-7328-4c63-9559-912f70ae2296","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:36272","PortSpecifier":{"PortValue":36272}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.73:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"59c8c952-7328-4c63-9559-912f70ae2296","method":"POST","path":"/ai-tenant-e2e-ipp-a-3261e1/ipp-route-3261e1/v1/chat/completions","host":"e2e-ipp-a-3261e1.apps.cf8a1ea2-2f33-439b-88a7-aa9ffbf16b67.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-29T15:29:06Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"59c8c952-7328-4c63-9559-912f70ae2296","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:36272","PortSpecifier":{"PortValue":36272}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.73:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785338946,"nanos":233973827},"http":{"id":"59c8c952-7328-4c63-9559-912f70ae2296","method":"POST","headers":{":authority":"e2e-ipp-a-3261e1.apps.cf8a1ea2-2f33-439b-88a7-aa9ffbf16b67.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-ipp-a-3261e1/ipp-route-3261e1/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T15:29:06Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"59c8c952-7328-4c63-9559-912f70ae2296","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-9L780RWJ4r3Jasuh_QmiMq6B4hewrCirqkSPluP41uWmMAsKFR1te6bTYtB7"}
{"level":"debug","ts":"2026-07-29T15:29:06Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"59c8c952-7328-4c63-9559-912f70ae2296","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-ipp-a-3261e1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-9L780RWJ4r3Jasuh_QmiMq6B4hewrCirqkSPluP41uWmMAsKFR1te6bTYtB7\"}"}
{"level":"debug","ts":"2026-07-29T15:29:06Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"59c8c952-7328-4c63-9559-912f70ae2296","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-ipp-a-3261e1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"eedefe75-325a-4a0b-b2d1-86a53dc716cd","keyName":"e2e-ipp-3261e1","subscription":"ipp-route-3261e1-sub","tenant":"e2e-ipp-a-3261e1","userId":"eedefe75-325a-4a0b-b2d1-86a53dc716cd","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-29T15:29:06Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"59c8c952-7328-4c63-9559-912f70ae2296","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-ipp-a-3261e1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-ipp-a-3261e1/ipp-route-3261e1\",\"requestedSubscription\":\"ipp-route-3261e1-sub\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-29T15:29:06Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"59c8c952-7328-4c63-9559-912f70ae2296","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-ipp-a-3261e1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-ipp-a-3261e1/models/facebook/opt-125m","name":"ipp-route-3261e1","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"ipp-route-3261e1-sub","namespace":"ai-tenant-e2e-ipp-a-3261e1","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-ipp-a-3261e1/ipp-route-3261e1"}}
{"level":"debug","ts":"2026-07-29T15:29:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"59c8c952-7328-4c63-9559-912f70ae2296","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T15:29:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"59c8c952-7328-4c63-9559-912f70ae2296","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T15:29:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"59c8c952-7328-4c63-9559-912f70ae2296","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T15:29:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"59c8c952-7328-4c63-9559-912f70ae2296","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-ipp-a-3261e1/ipp-route-3261e1\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-ipp-a-3261e1/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T15:29:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"59c8c952-7328-4c63-9559-912f70ae2296","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T15:29:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"59c8c952-7328-4c63-9559-912f70ae2296","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-29T15:29:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"59c8c952-7328-4c63-9559-912f70ae2296","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-29T15:29:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"59c8c952-7328-4c63-9559-912f70ae2296","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"ipp-route-3261e1-sub"}
{"level":"debug","ts":"2026-07-29T15:29:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"59c8c952-7328-4c63-9559-912f70ae2296","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"eedefe75-325a-4a0b-b2d1-86a53dc716cd","keyName":"e2e-ipp-3261e1","selected_subscription":"ipp-route-3261e1-sub","selected_subscription_key":"ai-tenant-e2e-ipp-a-3261e1/ipp-route-3261e1-sub@ai-tenant-e2e-ipp-a-3261e1/ipp-route-3261e1","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-ipp-a-3261e1/models/facebook/opt-125m","name":"ipp-route-3261e1","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"ipp-route-3261e1-sub","namespace":"ai-tenant-e2e-ipp-a-3261e1","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-ipp-a-3261e1/ipp-route-3261e1"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-29T15:29:06Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"59c8c952-7328-4c63-9559-912f70ae2296","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-29T15:29:06Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"59c8c952-7328-4c63-9559-912f70ae2296","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-29T15:30:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/60885dc14ec40c96538f6b1359c6e206691664e4432b9afe32cfb98f79176e22"}
{"level":"info","ts":"2026-07-29T15:30:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/dd66d9be83306e8e2dce482be5a9e0d8c9e25fefbcff5a5f2e038f5d89e392ba"}
{"level":"info","ts":"2026-07-29T15:30:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f068e058f107ee9744804a6eecef1dcbee6932fb3543d76dd479693e8a9b231b"}
{"level":"info","ts":"2026-07-29T15:30:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c46b6cae1d6a335f3fb757dfb0f808e2d2168c5e5258077c7852ea6865410d5f"}
{"level":"info","ts":"2026-07-29T15:30:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e8e963a44db02b40dcb96389fb0b580f0fa7d3cbf612e86a174677f83b2b58d7"}
{"level":"info","ts":"2026-07-29T15:30:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f1ba0256b23873321ef8118b293c1e291c033446ec685731cddc7fb85e4633b4"}
{"level":"info","ts":"2026-07-29T15:30:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1258fb539f19ebe7c8cd860659c2fdfe697644e47ab50e6cddfb5f7c5a2856e4"}
{"level":"info","ts":"2026-07-29T15:30:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9bef10e1543434ab9bdac9e478450aa31f34e05807ec0bda60456ef279083b19"}
{"level":"info","ts":"2026-07-29T15:30:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f69d6d7e2178fcdae8732cbcccd157325eabd2f6ed7e9487cc436ad6877d8861"}
{"level":"info","ts":"2026-07-29T15:30:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c1cb1a42d8c92339191913c0d7d9254e6076e9df9210b42c495346e593ad6248"}
{"level":"info","ts":"2026-07-29T15:30:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6fb9f9075af3fa51be0a1d505a6a1ffa8999ea0dfff6e5e073c5288fd1de8a5f"}
{"level":"info","ts":"2026-07-29T15:30:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c668aa9a0776367b60d83a9c1a526f1955d51de22eb1a325580a9f424e302b1f"}