{"level":"info","ts":"2026-07-09T15:01:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ed6949d5063aea803d8960fe22aa918b125c1ff9f56dbb81bc44671c3a7a0373"}
{"level":"debug","ts":"2026-07-09T15:01:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ed6949d5063aea803d8960fe22aa918b125c1ff9f56dbb81bc44671c3a7a0373","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T15:01:13Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T15:01:13Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ed6949d5063aea803d8960fe22aa918b125c1ff9f56dbb81bc44671c3a7a0373"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T15:01:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ed6949d5063aea803d8960fe22aa918b125c1ff9f56dbb81bc44671c3a7a0373","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T15:01:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ed6949d5063aea803d8960fe22aa918b125c1ff9f56dbb81bc44671c3a7a0373","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T15:01:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fda74c5da2375ee23f9607201be7ec4c274402c0714bf6808ca2d4257ba949c8","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T15:01:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ed6949d5063aea803d8960fe22aa918b125c1ff9f56dbb81bc44671c3a7a0373"}
{"level":"info","ts":"2026-07-09T15:01:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fda74c5da2375ee23f9607201be7ec4c274402c0714bf6808ca2d4257ba949c8"}
{"level":"debug","ts":"2026-07-09T15:01:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b6bb901368300e03918d1defbcf1831459ac474ac7b1d8eb22d200ffa2e57466","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T15:01:14Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T15:01:14Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T15:01:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b6bb901368300e03918d1defbcf1831459ac474ac7b1d8eb22d200ffa2e57466","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T15:01:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b6bb901368300e03918d1defbcf1831459ac474ac7b1d8eb22d200ffa2e57466","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T15:01:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b6bb901368300e03918d1defbcf1831459ac474ac7b1d8eb22d200ffa2e57466","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T15:01:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b6bb901368300e03918d1defbcf1831459ac474ac7b1d8eb22d200ffa2e57466"}
{"level":"debug","ts":"2026-07-09T15:01:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b6bb901368300e03918d1defbcf1831459ac474ac7b1d8eb22d200ffa2e57466","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T15:01:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b6bb901368300e03918d1defbcf1831459ac474ac7b1d8eb22d200ffa2e57466"}
{"level":"debug","ts":"2026-07-09T15:01:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b6bb901368300e03918d1defbcf1831459ac474ac7b1d8eb22d200ffa2e57466","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T15:01:14Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T15:01:14Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b6bb901368300e03918d1defbcf1831459ac474ac7b1d8eb22d200ffa2e57466"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T15:01:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b6bb901368300e03918d1defbcf1831459ac474ac7b1d8eb22d200ffa2e57466","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T15:01:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b6bb901368300e03918d1defbcf1831459ac474ac7b1d8eb22d200ffa2e57466","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T15:01:14Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T15:01:14Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T15:01:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b6bb901368300e03918d1defbcf1831459ac474ac7b1d8eb22d200ffa2e57466","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T15:01:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b6bb901368300e03918d1defbcf1831459ac474ac7b1d8eb22d200ffa2e57466","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T15:01:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b6bb901368300e03918d1defbcf1831459ac474ac7b1d8eb22d200ffa2e57466","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T15:01:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b6bb901368300e03918d1defbcf1831459ac474ac7b1d8eb22d200ffa2e57466"}
{"level":"debug","ts":"2026-07-09T15:01:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b6bb901368300e03918d1defbcf1831459ac474ac7b1d8eb22d200ffa2e57466","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T15:01:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b6bb901368300e03918d1defbcf1831459ac474ac7b1d8eb22d200ffa2e57466"}
{"level":"debug","ts":"2026-07-09T15:01:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b6bb901368300e03918d1defbcf1831459ac474ac7b1d8eb22d200ffa2e57466","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T15:01:14Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T15:01:14Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b6bb901368300e03918d1defbcf1831459ac474ac7b1d8eb22d200ffa2e57466"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T15:01:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b6bb901368300e03918d1defbcf1831459ac474ac7b1d8eb22d200ffa2e57466","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T15:01:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b6bb901368300e03918d1defbcf1831459ac474ac7b1d8eb22d200ffa2e57466","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T15:01:14Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T15:01:14Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T15:01:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b6bb901368300e03918d1defbcf1831459ac474ac7b1d8eb22d200ffa2e57466","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T15:01:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c56f4ecba0d7dbfac9848516507f899a56dd63d2a8c3bf6582b8d8735f151287","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T15:01:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b6bb901368300e03918d1defbcf1831459ac474ac7b1d8eb22d200ffa2e57466","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T15:01:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b6bb901368300e03918d1defbcf1831459ac474ac7b1d8eb22d200ffa2e57466","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T15:01:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b6bb901368300e03918d1defbcf1831459ac474ac7b1d8eb22d200ffa2e57466"}
{"level":"debug","ts":"2026-07-09T15:01:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b6bb901368300e03918d1defbcf1831459ac474ac7b1d8eb22d200ffa2e57466","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T15:01:14Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T15:01:14Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b6bb901368300e03918d1defbcf1831459ac474ac7b1d8eb22d200ffa2e57466"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T15:01:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c56f4ecba0d7dbfac9848516507f899a56dd63d2a8c3bf6582b8d8735f151287"}
{"level":"info","ts":"2026-07-09T15:01:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b6bb901368300e03918d1defbcf1831459ac474ac7b1d8eb22d200ffa2e57466","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T15:01:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b6bb901368300e03918d1defbcf1831459ac474ac7b1d8eb22d200ffa2e57466","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T15:01:14Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T15:01:14Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T15:01:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b6bb901368300e03918d1defbcf1831459ac474ac7b1d8eb22d200ffa2e57466"}
{"level":"info","ts":"2026-07-09T15:01:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b6bb901368300e03918d1defbcf1831459ac474ac7b1d8eb22d200ffa2e57466","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T15:01:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b6bb901368300e03918d1defbcf1831459ac474ac7b1d8eb22d200ffa2e57466","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T15:01:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b6bb901368300e03918d1defbcf1831459ac474ac7b1d8eb22d200ffa2e57466","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T15:01:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b6bb901368300e03918d1defbcf1831459ac474ac7b1d8eb22d200ffa2e57466"}
{"level":"debug","ts":"2026-07-09T15:01:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b6bb901368300e03918d1defbcf1831459ac474ac7b1d8eb22d200ffa2e57466","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T15:01:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b6bb901368300e03918d1defbcf1831459ac474ac7b1d8eb22d200ffa2e57466"}
{"level":"debug","ts":"2026-07-09T15:01:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b6bb901368300e03918d1defbcf1831459ac474ac7b1d8eb22d200ffa2e57466","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T15:01:14Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T15:01:14Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b6bb901368300e03918d1defbcf1831459ac474ac7b1d8eb22d200ffa2e57466"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T15:01:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b6bb901368300e03918d1defbcf1831459ac474ac7b1d8eb22d200ffa2e57466","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T15:01:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b6bb901368300e03918d1defbcf1831459ac474ac7b1d8eb22d200ffa2e57466","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T15:01:14Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T15:01:14Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T15:01:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b6bb901368300e03918d1defbcf1831459ac474ac7b1d8eb22d200ffa2e57466","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T15:01:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b6bb901368300e03918d1defbcf1831459ac474ac7b1d8eb22d200ffa2e57466","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T15:01:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b6bb901368300e03918d1defbcf1831459ac474ac7b1d8eb22d200ffa2e57466","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T15:01:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b6bb901368300e03918d1defbcf1831459ac474ac7b1d8eb22d200ffa2e57466"}
{"level":"debug","ts":"2026-07-09T15:01:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b6bb901368300e03918d1defbcf1831459ac474ac7b1d8eb22d200ffa2e57466","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T15:01:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b6bb901368300e03918d1defbcf1831459ac474ac7b1d8eb22d200ffa2e57466"}
{"level":"debug","ts":"2026-07-09T15:01:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"82f55224f7a6ab83e008ca7097440e9dcffb6b11a4b9e25440bfe544ad1a64f7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T15:01:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/82f55224f7a6ab83e008ca7097440e9dcffb6b11a4b9e25440bfe544ad1a64f7"}
{"level":"debug","ts":"2026-07-09T15:01:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b6bb901368300e03918d1defbcf1831459ac474ac7b1d8eb22d200ffa2e57466","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T15:01:14Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T15:01:14Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b6bb901368300e03918d1defbcf1831459ac474ac7b1d8eb22d200ffa2e57466"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T15:01:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b6bb901368300e03918d1defbcf1831459ac474ac7b1d8eb22d200ffa2e57466","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T15:01:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b6bb901368300e03918d1defbcf1831459ac474ac7b1d8eb22d200ffa2e57466","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T15:01:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b6bb901368300e03918d1defbcf1831459ac474ac7b1d8eb22d200ffa2e57466"}
{"level":"debug","ts":"2026-07-09T15:01:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c159953242248310e98654787c6aa1d788bf6639b45bdf1b8ddb61ea202ed53f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T15:01:14Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T15:01:14Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T15:01:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c159953242248310e98654787c6aa1d788bf6639b45bdf1b8ddb61ea202ed53f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T15:01:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c159953242248310e98654787c6aa1d788bf6639b45bdf1b8ddb61ea202ed53f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T15:01:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c159953242248310e98654787c6aa1d788bf6639b45bdf1b8ddb61ea202ed53f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T15:01:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c159953242248310e98654787c6aa1d788bf6639b45bdf1b8ddb61ea202ed53f"}
{"level":"debug","ts":"2026-07-09T15:01:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c159953242248310e98654787c6aa1d788bf6639b45bdf1b8ddb61ea202ed53f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T15:01:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c159953242248310e98654787c6aa1d788bf6639b45bdf1b8ddb61ea202ed53f"}
{"level":"debug","ts":"2026-07-09T15:01:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c159953242248310e98654787c6aa1d788bf6639b45bdf1b8ddb61ea202ed53f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T15:01:14Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T15:01:14Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c159953242248310e98654787c6aa1d788bf6639b45bdf1b8ddb61ea202ed53f"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T15:01:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c159953242248310e98654787c6aa1d788bf6639b45bdf1b8ddb61ea202ed53f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T15:01:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c159953242248310e98654787c6aa1d788bf6639b45bdf1b8ddb61ea202ed53f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T15:01:14Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T15:01:14Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T15:01:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c159953242248310e98654787c6aa1d788bf6639b45bdf1b8ddb61ea202ed53f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T15:01:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"627ec91befe174e25c1d3a1a17e5abe30c74aecfcefcf288832663df6f071606","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T15:01:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c159953242248310e98654787c6aa1d788bf6639b45bdf1b8ddb61ea202ed53f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T15:01:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c159953242248310e98654787c6aa1d788bf6639b45bdf1b8ddb61ea202ed53f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T15:01:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c159953242248310e98654787c6aa1d788bf6639b45bdf1b8ddb61ea202ed53f"}
{"level":"debug","ts":"2026-07-09T15:01:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c159953242248310e98654787c6aa1d788bf6639b45bdf1b8ddb61ea202ed53f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T15:01:14Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T15:01:14Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c159953242248310e98654787c6aa1d788bf6639b45bdf1b8ddb61ea202ed53f"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T15:01:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/627ec91befe174e25c1d3a1a17e5abe30c74aecfcefcf288832663df6f071606"}
{"level":"info","ts":"2026-07-09T15:01:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c159953242248310e98654787c6aa1d788bf6639b45bdf1b8ddb61ea202ed53f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T15:01:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c159953242248310e98654787c6aa1d788bf6639b45bdf1b8ddb61ea202ed53f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T15:01:14Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T15:01:14Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T15:01:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c159953242248310e98654787c6aa1d788bf6639b45bdf1b8ddb61ea202ed53f"}
{"level":"info","ts":"2026-07-09T15:01:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c159953242248310e98654787c6aa1d788bf6639b45bdf1b8ddb61ea202ed53f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T15:01:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c159953242248310e98654787c6aa1d788bf6639b45bdf1b8ddb61ea202ed53f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T15:01:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c159953242248310e98654787c6aa1d788bf6639b45bdf1b8ddb61ea202ed53f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T15:01:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c159953242248310e98654787c6aa1d788bf6639b45bdf1b8ddb61ea202ed53f"}
{"level":"debug","ts":"2026-07-09T15:01:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c159953242248310e98654787c6aa1d788bf6639b45bdf1b8ddb61ea202ed53f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T15:01:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c159953242248310e98654787c6aa1d788bf6639b45bdf1b8ddb61ea202ed53f"}
{"level":"debug","ts":"2026-07-09T15:01:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c159953242248310e98654787c6aa1d788bf6639b45bdf1b8ddb61ea202ed53f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T15:01:14Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T15:01:14Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c159953242248310e98654787c6aa1d788bf6639b45bdf1b8ddb61ea202ed53f"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T15:01:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c159953242248310e98654787c6aa1d788bf6639b45bdf1b8ddb61ea202ed53f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T15:01:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c159953242248310e98654787c6aa1d788bf6639b45bdf1b8ddb61ea202ed53f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T15:01:14Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T15:01:14Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T15:01:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c159953242248310e98654787c6aa1d788bf6639b45bdf1b8ddb61ea202ed53f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T15:01:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c159953242248310e98654787c6aa1d788bf6639b45bdf1b8ddb61ea202ed53f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T15:01:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c159953242248310e98654787c6aa1d788bf6639b45bdf1b8ddb61ea202ed53f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T15:01:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c159953242248310e98654787c6aa1d788bf6639b45bdf1b8ddb61ea202ed53f"}
{"level":"debug","ts":"2026-07-09T15:01:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c159953242248310e98654787c6aa1d788bf6639b45bdf1b8ddb61ea202ed53f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T15:01:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"94cb06f9357505c917cf287420967bf9d136b0690405d3cccf947ef4fa58ed25","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T15:01:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c159953242248310e98654787c6aa1d788bf6639b45bdf1b8ddb61ea202ed53f"}
{"level":"info","ts":"2026-07-09T15:01:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/94cb06f9357505c917cf287420967bf9d136b0690405d3cccf947ef4fa58ed25"}
{"level":"debug","ts":"2026-07-09T15:01:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c159953242248310e98654787c6aa1d788bf6639b45bdf1b8ddb61ea202ed53f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T15:01:14Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T15:01:14Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c159953242248310e98654787c6aa1d788bf6639b45bdf1b8ddb61ea202ed53f"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T15:01:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c159953242248310e98654787c6aa1d788bf6639b45bdf1b8ddb61ea202ed53f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T15:01:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c159953242248310e98654787c6aa1d788bf6639b45bdf1b8ddb61ea202ed53f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T15:01:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c159953242248310e98654787c6aa1d788bf6639b45bdf1b8ddb61ea202ed53f"}
{"level":"debug","ts":"2026-07-09T15:01:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4511cdb38e9d440abc94958a74512fce37d61afe8708088d8ccc44d1ab896abe","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T15:01:15Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T15:01:15Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T15:01:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4511cdb38e9d440abc94958a74512fce37d61afe8708088d8ccc44d1ab896abe","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T15:01:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4511cdb38e9d440abc94958a74512fce37d61afe8708088d8ccc44d1ab896abe","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T15:01:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4511cdb38e9d440abc94958a74512fce37d61afe8708088d8ccc44d1ab896abe","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T15:01:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4511cdb38e9d440abc94958a74512fce37d61afe8708088d8ccc44d1ab896abe"}
{"level":"debug","ts":"2026-07-09T15:01:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4511cdb38e9d440abc94958a74512fce37d61afe8708088d8ccc44d1ab896abe","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T15:01:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4511cdb38e9d440abc94958a74512fce37d61afe8708088d8ccc44d1ab896abe"}
{"level":"debug","ts":"2026-07-09T15:01:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4511cdb38e9d440abc94958a74512fce37d61afe8708088d8ccc44d1ab896abe","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T15:01:15Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T15:01:15Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4511cdb38e9d440abc94958a74512fce37d61afe8708088d8ccc44d1ab896abe"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T15:01:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4511cdb38e9d440abc94958a74512fce37d61afe8708088d8ccc44d1ab896abe","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T15:01:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4511cdb38e9d440abc94958a74512fce37d61afe8708088d8ccc44d1ab896abe","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T15:01:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f6f46892be05920960366a750f3d311c41c1fb821b974ec05d8b10a565227327","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T15:01:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4511cdb38e9d440abc94958a74512fce37d61afe8708088d8ccc44d1ab896abe"}
{"level":"info","ts":"2026-07-09T15:01:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f6f46892be05920960366a750f3d311c41c1fb821b974ec05d8b10a565227327"}
{"level":"debug","ts":"2026-07-09T15:01:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7e838e5b498dea8d021cf9c8efb81af65617a5ab1dda8c85ce5c043942cbb068","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T15:01:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"05a04e6df5c8ae35aec22ee4f1adaf00168aa70b6d35a848089ffdf8ee9ce3a7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T15:01:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7e838e5b498dea8d021cf9c8efb81af65617a5ab1dda8c85ce5c043942cbb068"}
{"level":"debug","ts":"2026-07-09T15:01:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b130ceb3d2b2493de0737cbf4d94821a67f603725759b7590893daec5e5938f1","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T15:01:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/05a04e6df5c8ae35aec22ee4f1adaf00168aa70b6d35a848089ffdf8ee9ce3a7"}
{"level":"info","ts":"2026-07-09T15:01:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b130ceb3d2b2493de0737cbf4d94821a67f603725759b7590893daec5e5938f1"}
{"level":"debug","ts":"2026-07-09T15:01:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1ab2dec9ff9ffdfebad990e8bfc14f54f1cefb6115b19bbafc57eb010093b877","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T15:01:15Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T15:01:15Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T15:01:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1ab2dec9ff9ffdfebad990e8bfc14f54f1cefb6115b19bbafc57eb010093b877","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T15:01:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a035feb8bcd3de39fbdcb30a0220b60306b37df7e930b282aea1d96f8efd7374","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T15:01:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1ab2dec9ff9ffdfebad990e8bfc14f54f1cefb6115b19bbafc57eb010093b877","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T15:01:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1ab2dec9ff9ffdfebad990e8bfc14f54f1cefb6115b19bbafc57eb010093b877","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T15:01:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1ab2dec9ff9ffdfebad990e8bfc14f54f1cefb6115b19bbafc57eb010093b877"}
{"level":"debug","ts":"2026-07-09T15:01:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2f12ea4bd8abd60734067c4c880f7528118ba1488e181b1c470c772e18ded3f9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T15:01:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1ab2dec9ff9ffdfebad990e8bfc14f54f1cefb6115b19bbafc57eb010093b877","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T15:01:15Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T15:01:15Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1ab2dec9ff9ffdfebad990e8bfc14f54f1cefb6115b19bbafc57eb010093b877"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T15:01:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a035feb8bcd3de39fbdcb30a0220b60306b37df7e930b282aea1d96f8efd7374"}
{"level":"info","ts":"2026-07-09T15:01:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1ab2dec9ff9ffdfebad990e8bfc14f54f1cefb6115b19bbafc57eb010093b877","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T15:01:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d2d354ee4d5545791d0c57b3b9334a0aa3d59628488b6b8714bd934b344892e8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T15:01:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1ab2dec9ff9ffdfebad990e8bfc14f54f1cefb6115b19bbafc57eb010093b877","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T15:01:15Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T15:01:15Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T15:01:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1ab2dec9ff9ffdfebad990e8bfc14f54f1cefb6115b19bbafc57eb010093b877"}
{"level":"info","ts":"2026-07-09T15:01:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1ab2dec9ff9ffdfebad990e8bfc14f54f1cefb6115b19bbafc57eb010093b877","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T15:01:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7b28b6270385ada1b9c1c374fd8768314faa2e3c3b67680dd43fc995b7388d21","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T15:01:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1ab2dec9ff9ffdfebad990e8bfc14f54f1cefb6115b19bbafc57eb010093b877","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T15:01:15Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T15:01:15Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1ab2dec9ff9ffdfebad990e8bfc14f54f1cefb6115b19bbafc57eb010093b877"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T15:01:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1ab2dec9ff9ffdfebad990e8bfc14f54f1cefb6115b19bbafc57eb010093b877","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T15:01:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1ab2dec9ff9ffdfebad990e8bfc14f54f1cefb6115b19bbafc57eb010093b877","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T15:01:15Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T15:01:15Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1ab2dec9ff9ffdfebad990e8bfc14f54f1cefb6115b19bbafc57eb010093b877"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T15:01:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2f12ea4bd8abd60734067c4c880f7528118ba1488e181b1c470c772e18ded3f9"}
{"level":"error","ts":"2026-07-09T15:01:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"1ab2dec9ff9ffdfebad990e8bfc14f54f1cefb6115b19bbafc57eb010093b877","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"1ab2dec9ff9ffdfebad990e8bfc14f54f1cefb6115b19bbafc57eb010093b877\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-09T15:01:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1ab2dec9ff9ffdfebad990e8bfc14f54f1cefb6115b19bbafc57eb010093b877","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T15:01:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"89b8b158620363d7787a096b2aaad80e4e2515e2d072600b67243d87fc1ddf7b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T15:01:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1ab2dec9ff9ffdfebad990e8bfc14f54f1cefb6115b19bbafc57eb010093b877","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T15:01:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d2d354ee4d5545791d0c57b3b9334a0aa3d59628488b6b8714bd934b344892e8"}
{"level":"debug","ts":"2026-07-09T15:01:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4f59c1972fde4dcbf127a4adea70aa36214364a38b42b96966d6a79ff67a05a1","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T15:01:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7b28b6270385ada1b9c1c374fd8768314faa2e3c3b67680dd43fc995b7388d21"}
{"level":"debug","ts":"2026-07-09T15:01:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e3c30dafee927cdef7bb60052e9b6714d9664905800ee0dbd3806d4190bb123a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T15:01:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f1d10cf66d5a68d1997c8846eb716abeab20021fdba26d3ecaf69f023dd100f8","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T15:01:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1ab2dec9ff9ffdfebad990e8bfc14f54f1cefb6115b19bbafc57eb010093b877"}
{"level":"info","ts":"2026-07-09T15:01:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/89b8b158620363d7787a096b2aaad80e4e2515e2d072600b67243d87fc1ddf7b"}
{"level":"info","ts":"2026-07-09T15:01:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4f59c1972fde4dcbf127a4adea70aa36214364a38b42b96966d6a79ff67a05a1"}
{"level":"debug","ts":"2026-07-09T15:01:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"97953c07b1b30bfa8b25e03fd7241b4a190b48bd867fdf0838c7be52e809f837","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T15:01:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e3c30dafee927cdef7bb60052e9b6714d9664905800ee0dbd3806d4190bb123a"}
{"level":"debug","ts":"2026-07-09T15:01:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"bde2c31a1bd828cc7c8980b79b34281f13bc2762e0c1caac072690fdfc72a073","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T15:01:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f1d10cf66d5a68d1997c8846eb716abeab20021fdba26d3ecaf69f023dd100f8"}
{"level":"info","ts":"2026-07-09T15:01:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/97953c07b1b30bfa8b25e03fd7241b4a190b48bd867fdf0838c7be52e809f837"}
{"level":"info","ts":"2026-07-09T15:01:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bde2c31a1bd828cc7c8980b79b34281f13bc2762e0c1caac072690fdfc72a073"}
{"level":"info","ts":"2026-07-09T15:01:18Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b65ed6c1-ad77-4136-a2be-79e848e517fd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:33340","PortSpecifier":{"PortValue":33340}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.65:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b65ed6c1-ad77-4136-a2be-79e848e517fd","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-0d877f.apps.7bfc212a-a32c-41f1-9546-498d5ebffd32.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T15:01:18Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b65ed6c1-ad77-4136-a2be-79e848e517fd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:33340","PortSpecifier":{"PortValue":33340}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.65:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783609278,"nanos":773012523},"http":{"id":"b65ed6c1-ad77-4136-a2be-79e848e517fd","method":"POST","headers":{":authority":"e2e-shared-a-0d877f.apps.7bfc212a-a32c-41f1-9546-498d5ebffd32.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T15:01:18Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"b65ed6c1-ad77-4136-a2be-79e848e517fd","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T15:01:18Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b65ed6c1-ad77-4136-a2be-79e848e517fd","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"13687913-8580-437c-b6bc-441dcfc7fd35","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=864bb746-cbc5-4f27-b7a7-6726d44d533c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/498d5ebffd32"]}}
{"level":"debug","ts":"2026-07-09T15:01:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b65ed6c1-ad77-4136-a2be-79e848e517fd","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/498d5ebffd32"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=864bb746-cbc5-4f27-b7a7-6726d44d533c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"13687913-8580-437c-b6bc-441dcfc7fd35","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"bde2c31a1bd828cc7c8980b79b34281f13bc2762e0c1caac072690fdfc72a073"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.65:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-0d877f.apps.7bfc212a-a32c-41f1-9546-498d5ebffd32.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T15:01:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b65ed6c1-ad77-4136-a2be-79e848e517fd","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:01:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b65ed6c1-ad77-4136-a2be-79e848e517fd","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:01:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b65ed6c1-ad77-4136-a2be-79e848e517fd","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-0d877f/rate-test-model-0d877f\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:01:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"b65ed6c1-ad77-4136-a2be-79e848e517fd","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T15:01:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b65ed6c1-ad77-4136-a2be-79e848e517fd","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T15:01:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b65ed6c1-ad77-4136-a2be-79e848e517fd","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T15:01:18Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b65ed6c1-ad77-4136-a2be-79e848e517fd","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T15:01:18Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b65ed6c1-ad77-4136-a2be-79e848e517fd","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T15:01:18Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8b6763a1-b8da-4524-8003-332dcf7d946c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:53484","PortSpecifier":{"PortValue":53484}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.67:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"8b6763a1-b8da-4524-8003-332dcf7d946c","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-d74e21.apps.7bfc212a-a32c-41f1-9546-498d5ebffd32.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T15:01:18Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8b6763a1-b8da-4524-8003-332dcf7d946c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:53484","PortSpecifier":{"PortValue":53484}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.67:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783609278,"nanos":815837590},"http":{"id":"8b6763a1-b8da-4524-8003-332dcf7d946c","method":"POST","headers":{":authority":"e2e-shared-b-d74e21.apps.7bfc212a-a32c-41f1-9546-498d5ebffd32.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T15:01:18Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"8b6763a1-b8da-4524-8003-332dcf7d946c","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T15:01:18Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"8b6763a1-b8da-4524-8003-332dcf7d946c","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"13687913-8580-437c-b6bc-441dcfc7fd35","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=864bb746-cbc5-4f27-b7a7-6726d44d533c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/498d5ebffd32"]}}
{"level":"debug","ts":"2026-07-09T15:01:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"8b6763a1-b8da-4524-8003-332dcf7d946c","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/498d5ebffd32"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=864bb746-cbc5-4f27-b7a7-6726d44d533c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"13687913-8580-437c-b6bc-441dcfc7fd35","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"627ec91befe174e25c1d3a1a17e5abe30c74aecfcefcf288832663df6f071606"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.67:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-d74e21.apps.7bfc212a-a32c-41f1-9546-498d5ebffd32.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T15:01:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8b6763a1-b8da-4524-8003-332dcf7d946c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:01:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8b6763a1-b8da-4524-8003-332dcf7d946c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:01:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8b6763a1-b8da-4524-8003-332dcf7d946c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-d74e21/rate-test-model-d74e21\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:01:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"8b6763a1-b8da-4524-8003-332dcf7d946c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T15:01:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8b6763a1-b8da-4524-8003-332dcf7d946c","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T15:01:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8b6763a1-b8da-4524-8003-332dcf7d946c","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T15:01:18Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8b6763a1-b8da-4524-8003-332dcf7d946c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T15:01:18Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8b6763a1-b8da-4524-8003-332dcf7d946c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T15:01:18Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6c0748dc-8263-4579-b75f-3e997a56cf27","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:33354","PortSpecifier":{"PortValue":33354}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.65:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6c0748dc-8263-4579-b75f-3e997a56cf27","method":"POST","path":"/ai-tenant-e2e-shared-a-0d877f/rate-test-model-0d877f/v1/completions","host":"e2e-shared-a-0d877f.apps.7bfc212a-a32c-41f1-9546-498d5ebffd32.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T15:01:18Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6c0748dc-8263-4579-b75f-3e997a56cf27","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:33354","PortSpecifier":{"PortValue":33354}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.65:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783609278,"nanos":860191859},"http":{"id":"6c0748dc-8263-4579-b75f-3e997a56cf27","method":"POST","headers":{":authority":"e2e-shared-a-0d877f.apps.7bfc212a-a32c-41f1-9546-498d5ebffd32.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-0d877f/rate-test-model-0d877f/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T15:01:18Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6c0748dc-8263-4579-b75f-3e997a56cf27","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-2qo7tJOTcwEuYIyg_9cziJhXMATWr1BBwOBtgIUy35vcWL9Xg1CcUSuJviyZ"}
{"level":"debug","ts":"2026-07-09T15:01:18Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6c0748dc-8263-4579-b75f-3e997a56cf27","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-0d877f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-2qo7tJOTcwEuYIyg_9cziJhXMATWr1BBwOBtgIUy35vcWL9Xg1CcUSuJviyZ\"}"}
{"level":"debug","ts":"2026-07-09T15:01:18Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6c0748dc-8263-4579-b75f-3e997a56cf27","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-0d877f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"12ce4411-4097-408b-ae28-e39d068d0d3f","keyName":"e2e-rate-a-27e0c5","subscription":"e2e-rate-iso-a-27e0c5","tenant":"e2e-shared-a-0d877f","userId":"12ce4411-4097-408b-ae28-e39d068d0d3f","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T15:01:18Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6c0748dc-8263-4579-b75f-3e997a56cf27","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-0d877f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-0d877f/rate-test-model-0d877f\",\"requestedSubscription\":\"e2e-rate-iso-a-27e0c5\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T15:01:18Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6c0748dc-8263-4579-b75f-3e997a56cf27","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-0d877f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-0d877f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-27e0c5","namespace":"ai-tenant-e2e-shared-a-0d877f","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T15:01:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6c0748dc-8263-4579-b75f-3e997a56cf27","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T15:01:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6c0748dc-8263-4579-b75f-3e997a56cf27","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:01:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6c0748dc-8263-4579-b75f-3e997a56cf27","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:01:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6c0748dc-8263-4579-b75f-3e997a56cf27","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-0d877f/rate-test-model-0d877f\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:01:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6c0748dc-8263-4579-b75f-3e997a56cf27","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:01:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6c0748dc-8263-4579-b75f-3e997a56cf27","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T15:01:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6c0748dc-8263-4579-b75f-3e997a56cf27","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-27e0c5"}
{"level":"debug","ts":"2026-07-09T15:01:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6c0748dc-8263-4579-b75f-3e997a56cf27","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T15:01:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6c0748dc-8263-4579-b75f-3e997a56cf27","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"12ce4411-4097-408b-ae28-e39d068d0d3f","keyName":"e2e-rate-a-27e0c5","selected_subscription":"e2e-rate-iso-a-27e0c5","selected_subscription_key":"ai-tenant-e2e-shared-a-0d877f/e2e-rate-iso-a-27e0c5@ai-tenant-e2e-shared-a-0d877f/rate-test-model-0d877f","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-0d877f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-27e0c5","namespace":"ai-tenant-e2e-shared-a-0d877f","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T15:01:18Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6c0748dc-8263-4579-b75f-3e997a56cf27","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T15:01:18Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6c0748dc-8263-4579-b75f-3e997a56cf27","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T15:01:19Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"96a923ed-bebd-48d1-814e-4d229cc659f1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:33358","PortSpecifier":{"PortValue":33358}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.65:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"96a923ed-bebd-48d1-814e-4d229cc659f1","method":"POST","path":"/ai-tenant-e2e-shared-a-0d877f/rate-test-model-0d877f/v1/completions","host":"e2e-shared-a-0d877f.apps.7bfc212a-a32c-41f1-9546-498d5ebffd32.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T15:01:19Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"96a923ed-bebd-48d1-814e-4d229cc659f1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:33358","PortSpecifier":{"PortValue":33358}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.65:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783609279,"nanos":923038131},"http":{"id":"96a923ed-bebd-48d1-814e-4d229cc659f1","method":"POST","headers":{":authority":"e2e-shared-a-0d877f.apps.7bfc212a-a32c-41f1-9546-498d5ebffd32.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-0d877f/rate-test-model-0d877f/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T15:01:19Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"96a923ed-bebd-48d1-814e-4d229cc659f1","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-2qo7tJOTcwEuYIyg_9cziJhXMATWr1BBwOBtgIUy35vcWL9Xg1CcUSuJviyZ"}
{"level":"debug","ts":"2026-07-09T15:01:19Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"96a923ed-bebd-48d1-814e-4d229cc659f1","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-0d877f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-2qo7tJOTcwEuYIyg_9cziJhXMATWr1BBwOBtgIUy35vcWL9Xg1CcUSuJviyZ\"}"}
{"level":"debug","ts":"2026-07-09T15:01:19Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"96a923ed-bebd-48d1-814e-4d229cc659f1","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-0d877f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"12ce4411-4097-408b-ae28-e39d068d0d3f","keyName":"e2e-rate-a-27e0c5","subscription":"e2e-rate-iso-a-27e0c5","tenant":"e2e-shared-a-0d877f","userId":"12ce4411-4097-408b-ae28-e39d068d0d3f","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T15:01:19Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"96a923ed-bebd-48d1-814e-4d229cc659f1","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-0d877f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-0d877f/rate-test-model-0d877f\",\"requestedSubscription\":\"e2e-rate-iso-a-27e0c5\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T15:01:19Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"96a923ed-bebd-48d1-814e-4d229cc659f1","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-0d877f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-0d877f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-27e0c5","namespace":"ai-tenant-e2e-shared-a-0d877f","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T15:01:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"96a923ed-bebd-48d1-814e-4d229cc659f1","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T15:01:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"96a923ed-bebd-48d1-814e-4d229cc659f1","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:01:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"96a923ed-bebd-48d1-814e-4d229cc659f1","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:01:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"96a923ed-bebd-48d1-814e-4d229cc659f1","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:01:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"96a923ed-bebd-48d1-814e-4d229cc659f1","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-0d877f/rate-test-model-0d877f\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:01:19Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"96a923ed-bebd-48d1-814e-4d229cc659f1","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T15:01:19Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"96a923ed-bebd-48d1-814e-4d229cc659f1","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T15:01:19Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"96a923ed-bebd-48d1-814e-4d229cc659f1","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-27e0c5"}
{"level":"debug","ts":"2026-07-09T15:01:19Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"96a923ed-bebd-48d1-814e-4d229cc659f1","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"12ce4411-4097-408b-ae28-e39d068d0d3f","keyName":"e2e-rate-a-27e0c5","selected_subscription":"e2e-rate-iso-a-27e0c5","selected_subscription_key":"ai-tenant-e2e-shared-a-0d877f/e2e-rate-iso-a-27e0c5@ai-tenant-e2e-shared-a-0d877f/rate-test-model-0d877f","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-0d877f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-27e0c5","namespace":"ai-tenant-e2e-shared-a-0d877f","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T15:01:19Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"96a923ed-bebd-48d1-814e-4d229cc659f1","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T15:01:19Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"96a923ed-bebd-48d1-814e-4d229cc659f1","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T15:01:20Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a343f83e-9590-4a06-b818-6d8af222303b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:33366","PortSpecifier":{"PortValue":33366}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.65:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a343f83e-9590-4a06-b818-6d8af222303b","method":"POST","path":"/ai-tenant-e2e-shared-a-0d877f/rate-test-model-0d877f/v1/completions","host":"e2e-shared-a-0d877f.apps.7bfc212a-a32c-41f1-9546-498d5ebffd32.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T15:01:20Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a343f83e-9590-4a06-b818-6d8af222303b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:33366","PortSpecifier":{"PortValue":33366}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.65:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783609280,"nanos":965811190},"http":{"id":"a343f83e-9590-4a06-b818-6d8af222303b","method":"POST","headers":{":authority":"e2e-shared-a-0d877f.apps.7bfc212a-a32c-41f1-9546-498d5ebffd32.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-0d877f/rate-test-model-0d877f/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T15:01:20Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a343f83e-9590-4a06-b818-6d8af222303b","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-2qo7tJOTcwEuYIyg_9cziJhXMATWr1BBwOBtgIUy35vcWL9Xg1CcUSuJviyZ"}
{"level":"debug","ts":"2026-07-09T15:01:20Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a343f83e-9590-4a06-b818-6d8af222303b","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-0d877f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-2qo7tJOTcwEuYIyg_9cziJhXMATWr1BBwOBtgIUy35vcWL9Xg1CcUSuJviyZ\"}"}
{"level":"debug","ts":"2026-07-09T15:01:20Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a343f83e-9590-4a06-b818-6d8af222303b","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-0d877f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"12ce4411-4097-408b-ae28-e39d068d0d3f","keyName":"e2e-rate-a-27e0c5","subscription":"e2e-rate-iso-a-27e0c5","tenant":"e2e-shared-a-0d877f","userId":"12ce4411-4097-408b-ae28-e39d068d0d3f","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T15:01:20Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a343f83e-9590-4a06-b818-6d8af222303b","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-0d877f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-0d877f/rate-test-model-0d877f\",\"requestedSubscription\":\"e2e-rate-iso-a-27e0c5\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T15:01:20Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a343f83e-9590-4a06-b818-6d8af222303b","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-0d877f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-0d877f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-27e0c5","namespace":"ai-tenant-e2e-shared-a-0d877f","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T15:01:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a343f83e-9590-4a06-b818-6d8af222303b","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T15:01:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a343f83e-9590-4a06-b818-6d8af222303b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:01:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a343f83e-9590-4a06-b818-6d8af222303b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:01:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a343f83e-9590-4a06-b818-6d8af222303b","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:01:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a343f83e-9590-4a06-b818-6d8af222303b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-0d877f/rate-test-model-0d877f\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:01:20Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a343f83e-9590-4a06-b818-6d8af222303b","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T15:01:20Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a343f83e-9590-4a06-b818-6d8af222303b","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-27e0c5"}
{"level":"debug","ts":"2026-07-09T15:01:20Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a343f83e-9590-4a06-b818-6d8af222303b","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T15:01:20Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a343f83e-9590-4a06-b818-6d8af222303b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"12ce4411-4097-408b-ae28-e39d068d0d3f","keyName":"e2e-rate-a-27e0c5","selected_subscription":"e2e-rate-iso-a-27e0c5","selected_subscription_key":"ai-tenant-e2e-shared-a-0d877f/e2e-rate-iso-a-27e0c5@ai-tenant-e2e-shared-a-0d877f/rate-test-model-0d877f","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-0d877f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-27e0c5","namespace":"ai-tenant-e2e-shared-a-0d877f","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T15:01:20Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a343f83e-9590-4a06-b818-6d8af222303b","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T15:01:20Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a343f83e-9590-4a06-b818-6d8af222303b","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T15:01:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0bebe268-428f-4383-bf0c-292d8285e018","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:54930","PortSpecifier":{"PortValue":54930}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.65:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0bebe268-428f-4383-bf0c-292d8285e018","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-0d877f.apps.7bfc212a-a32c-41f1-9546-498d5ebffd32.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T15:01:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0bebe268-428f-4383-bf0c-292d8285e018","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:54930","PortSpecifier":{"PortValue":54930}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.65:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783609289,"nanos":731017172},"http":{"id":"0bebe268-428f-4383-bf0c-292d8285e018","method":"POST","headers":{":authority":"e2e-shared-a-0d877f.apps.7bfc212a-a32c-41f1-9546-498d5ebffd32.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T15:01:29Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"0bebe268-428f-4383-bf0c-292d8285e018","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T15:01:29Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0bebe268-428f-4383-bf0c-292d8285e018","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"13687913-8580-437c-b6bc-441dcfc7fd35","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=864bb746-cbc5-4f27-b7a7-6726d44d533c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/498d5ebffd32"]}}
{"level":"debug","ts":"2026-07-09T15:01:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0bebe268-428f-4383-bf0c-292d8285e018","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/498d5ebffd32"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=864bb746-cbc5-4f27-b7a7-6726d44d533c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"13687913-8580-437c-b6bc-441dcfc7fd35","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"bde2c31a1bd828cc7c8980b79b34281f13bc2762e0c1caac072690fdfc72a073"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.65:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-0d877f.apps.7bfc212a-a32c-41f1-9546-498d5ebffd32.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T15:01:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0bebe268-428f-4383-bf0c-292d8285e018","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:01:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0bebe268-428f-4383-bf0c-292d8285e018","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:01:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0bebe268-428f-4383-bf0c-292d8285e018","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-0d877f/rate-test-model-0d877f\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:01:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"0bebe268-428f-4383-bf0c-292d8285e018","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T15:01:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0bebe268-428f-4383-bf0c-292d8285e018","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T15:01:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0bebe268-428f-4383-bf0c-292d8285e018","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T15:01:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0bebe268-428f-4383-bf0c-292d8285e018","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T15:01:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0bebe268-428f-4383-bf0c-292d8285e018","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T15:01:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c90077d1-dfd1-4a2f-86be-34b264897d27","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:56078","PortSpecifier":{"PortValue":56078}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.67:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c90077d1-dfd1-4a2f-86be-34b264897d27","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-d74e21.apps.7bfc212a-a32c-41f1-9546-498d5ebffd32.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T15:01:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c90077d1-dfd1-4a2f-86be-34b264897d27","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:56078","PortSpecifier":{"PortValue":56078}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.67:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783609289,"nanos":771104554},"http":{"id":"c90077d1-dfd1-4a2f-86be-34b264897d27","method":"POST","headers":{":authority":"e2e-shared-b-d74e21.apps.7bfc212a-a32c-41f1-9546-498d5ebffd32.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T15:01:29Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"c90077d1-dfd1-4a2f-86be-34b264897d27","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T15:01:29Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"c90077d1-dfd1-4a2f-86be-34b264897d27","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"13687913-8580-437c-b6bc-441dcfc7fd35","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=864bb746-cbc5-4f27-b7a7-6726d44d533c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/498d5ebffd32"]}}
{"level":"debug","ts":"2026-07-09T15:01:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"c90077d1-dfd1-4a2f-86be-34b264897d27","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/498d5ebffd32"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=864bb746-cbc5-4f27-b7a7-6726d44d533c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"13687913-8580-437c-b6bc-441dcfc7fd35","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"627ec91befe174e25c1d3a1a17e5abe30c74aecfcefcf288832663df6f071606"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.67:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-d74e21.apps.7bfc212a-a32c-41f1-9546-498d5ebffd32.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T15:01:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c90077d1-dfd1-4a2f-86be-34b264897d27","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:01:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c90077d1-dfd1-4a2f-86be-34b264897d27","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:01:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c90077d1-dfd1-4a2f-86be-34b264897d27","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-d74e21/rate-test-model-d74e21\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:01:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"c90077d1-dfd1-4a2f-86be-34b264897d27","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T15:01:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c90077d1-dfd1-4a2f-86be-34b264897d27","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T15:01:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c90077d1-dfd1-4a2f-86be-34b264897d27","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T15:01:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c90077d1-dfd1-4a2f-86be-34b264897d27","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T15:01:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c90077d1-dfd1-4a2f-86be-34b264897d27","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T15:01:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3dc71640-cb31-4d21-8cfc-204d0b866dc8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:54938","PortSpecifier":{"PortValue":54938}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.65:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3dc71640-cb31-4d21-8cfc-204d0b866dc8","method":"POST","path":"/ai-tenant-e2e-shared-a-0d877f/rate-test-model-0d877f/v1/completions","host":"e2e-shared-a-0d877f.apps.7bfc212a-a32c-41f1-9546-498d5ebffd32.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T15:01:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3dc71640-cb31-4d21-8cfc-204d0b866dc8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:54938","PortSpecifier":{"PortValue":54938}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.65:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783609289,"nanos":812166525},"http":{"id":"3dc71640-cb31-4d21-8cfc-204d0b866dc8","method":"POST","headers":{":authority":"e2e-shared-a-0d877f.apps.7bfc212a-a32c-41f1-9546-498d5ebffd32.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-0d877f/rate-test-model-0d877f/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T15:01:29Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3dc71640-cb31-4d21-8cfc-204d0b866dc8","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1W7j25YP51JxbCG5y_dkcpEIIW3L8QVucTbbKiHN6t2M9PrS8OfUCLEpyroVx"}
{"level":"debug","ts":"2026-07-09T15:01:29Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3dc71640-cb31-4d21-8cfc-204d0b866dc8","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-0d877f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1W7j25YP51JxbCG5y_dkcpEIIW3L8QVucTbbKiHN6t2M9PrS8OfUCLEpyroVx\"}"}
{"level":"debug","ts":"2026-07-09T15:01:29Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3dc71640-cb31-4d21-8cfc-204d0b866dc8","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-0d877f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"bf218e0e-b023-4f6d-bac6-12e33e872c5c","keyName":"e2e-rate-a-fa4cdd","subscription":"e2e-rate-iso-a-fa4cdd","tenant":"e2e-shared-a-0d877f","userId":"bf218e0e-b023-4f6d-bac6-12e33e872c5c","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T15:01:29Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3dc71640-cb31-4d21-8cfc-204d0b866dc8","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-0d877f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-0d877f/rate-test-model-0d877f\",\"requestedSubscription\":\"e2e-rate-iso-a-fa4cdd\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T15:01:29Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3dc71640-cb31-4d21-8cfc-204d0b866dc8","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-0d877f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-0d877f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-fa4cdd","namespace":"ai-tenant-e2e-shared-a-0d877f","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T15:01:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3dc71640-cb31-4d21-8cfc-204d0b866dc8","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T15:01:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3dc71640-cb31-4d21-8cfc-204d0b866dc8","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:01:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3dc71640-cb31-4d21-8cfc-204d0b866dc8","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:01:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3dc71640-cb31-4d21-8cfc-204d0b866dc8","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-0d877f/rate-test-model-0d877f\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:01:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3dc71640-cb31-4d21-8cfc-204d0b866dc8","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:01:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3dc71640-cb31-4d21-8cfc-204d0b866dc8","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T15:01:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3dc71640-cb31-4d21-8cfc-204d0b866dc8","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-fa4cdd"}
{"level":"debug","ts":"2026-07-09T15:01:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3dc71640-cb31-4d21-8cfc-204d0b866dc8","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T15:01:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3dc71640-cb31-4d21-8cfc-204d0b866dc8","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"bf218e0e-b023-4f6d-bac6-12e33e872c5c","keyName":"e2e-rate-a-fa4cdd","selected_subscription":"e2e-rate-iso-a-fa4cdd","selected_subscription_key":"ai-tenant-e2e-shared-a-0d877f/e2e-rate-iso-a-fa4cdd@ai-tenant-e2e-shared-a-0d877f/rate-test-model-0d877f","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-0d877f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-fa4cdd","namespace":"ai-tenant-e2e-shared-a-0d877f","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T15:01:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3dc71640-cb31-4d21-8cfc-204d0b866dc8","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T15:01:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3dc71640-cb31-4d21-8cfc-204d0b866dc8","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T15:01:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"bf2a0a20-30ca-460d-8a6f-906ca03d799c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:54954","PortSpecifier":{"PortValue":54954}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.65:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"bf2a0a20-30ca-460d-8a6f-906ca03d799c","method":"POST","path":"/ai-tenant-e2e-shared-a-0d877f/rate-test-model-0d877f/v1/completions","host":"e2e-shared-a-0d877f.apps.7bfc212a-a32c-41f1-9546-498d5ebffd32.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T15:01:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"bf2a0a20-30ca-460d-8a6f-906ca03d799c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:54954","PortSpecifier":{"PortValue":54954}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.65:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783609290,"nanos":851903330},"http":{"id":"bf2a0a20-30ca-460d-8a6f-906ca03d799c","method":"POST","headers":{":authority":"e2e-shared-a-0d877f.apps.7bfc212a-a32c-41f1-9546-498d5ebffd32.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-0d877f/rate-test-model-0d877f/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T15:01:30Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"bf2a0a20-30ca-460d-8a6f-906ca03d799c","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1W7j25YP51JxbCG5y_dkcpEIIW3L8QVucTbbKiHN6t2M9PrS8OfUCLEpyroVx"}
{"level":"debug","ts":"2026-07-09T15:01:30Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"bf2a0a20-30ca-460d-8a6f-906ca03d799c","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-0d877f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1W7j25YP51JxbCG5y_dkcpEIIW3L8QVucTbbKiHN6t2M9PrS8OfUCLEpyroVx\"}"}
{"level":"debug","ts":"2026-07-09T15:01:30Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"bf2a0a20-30ca-460d-8a6f-906ca03d799c","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-0d877f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"bf218e0e-b023-4f6d-bac6-12e33e872c5c","keyName":"e2e-rate-a-fa4cdd","subscription":"e2e-rate-iso-a-fa4cdd","tenant":"e2e-shared-a-0d877f","userId":"bf218e0e-b023-4f6d-bac6-12e33e872c5c","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T15:01:30Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"bf2a0a20-30ca-460d-8a6f-906ca03d799c","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-0d877f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-0d877f/rate-test-model-0d877f\",\"requestedSubscription\":\"e2e-rate-iso-a-fa4cdd\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T15:01:30Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"bf2a0a20-30ca-460d-8a6f-906ca03d799c","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-0d877f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-0d877f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-fa4cdd","namespace":"ai-tenant-e2e-shared-a-0d877f","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T15:01:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"bf2a0a20-30ca-460d-8a6f-906ca03d799c","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T15:01:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bf2a0a20-30ca-460d-8a6f-906ca03d799c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:01:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bf2a0a20-30ca-460d-8a6f-906ca03d799c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:01:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bf2a0a20-30ca-460d-8a6f-906ca03d799c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-0d877f/rate-test-model-0d877f\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:01:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bf2a0a20-30ca-460d-8a6f-906ca03d799c","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:01:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bf2a0a20-30ca-460d-8a6f-906ca03d799c","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T15:01:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bf2a0a20-30ca-460d-8a6f-906ca03d799c","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T15:01:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bf2a0a20-30ca-460d-8a6f-906ca03d799c","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-fa4cdd"}
{"level":"debug","ts":"2026-07-09T15:01:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bf2a0a20-30ca-460d-8a6f-906ca03d799c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"bf218e0e-b023-4f6d-bac6-12e33e872c5c","keyName":"e2e-rate-a-fa4cdd","selected_subscription":"e2e-rate-iso-a-fa4cdd","selected_subscription_key":"ai-tenant-e2e-shared-a-0d877f/e2e-rate-iso-a-fa4cdd@ai-tenant-e2e-shared-a-0d877f/rate-test-model-0d877f","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-0d877f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-fa4cdd","namespace":"ai-tenant-e2e-shared-a-0d877f","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T15:01:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"bf2a0a20-30ca-460d-8a6f-906ca03d799c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T15:01:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"bf2a0a20-30ca-460d-8a6f-906ca03d799c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T15:01:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5f203c89-8e4f-4cf6-b374-1f49a24cc59b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:54970","PortSpecifier":{"PortValue":54970}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.65:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5f203c89-8e4f-4cf6-b374-1f49a24cc59b","method":"POST","path":"/ai-tenant-e2e-shared-a-0d877f/rate-test-model-0d877f/v1/completions","host":"e2e-shared-a-0d877f.apps.7bfc212a-a32c-41f1-9546-498d5ebffd32.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T15:01:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5f203c89-8e4f-4cf6-b374-1f49a24cc59b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:54970","PortSpecifier":{"PortValue":54970}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.65:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783609291,"nanos":891904344},"http":{"id":"5f203c89-8e4f-4cf6-b374-1f49a24cc59b","method":"POST","headers":{":authority":"e2e-shared-a-0d877f.apps.7bfc212a-a32c-41f1-9546-498d5ebffd32.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-0d877f/rate-test-model-0d877f/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T15:01:31Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5f203c89-8e4f-4cf6-b374-1f49a24cc59b","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1W7j25YP51JxbCG5y_dkcpEIIW3L8QVucTbbKiHN6t2M9PrS8OfUCLEpyroVx"}
{"level":"debug","ts":"2026-07-09T15:01:31Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5f203c89-8e4f-4cf6-b374-1f49a24cc59b","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-0d877f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1W7j25YP51JxbCG5y_dkcpEIIW3L8QVucTbbKiHN6t2M9PrS8OfUCLEpyroVx\"}"}
{"level":"debug","ts":"2026-07-09T15:01:31Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5f203c89-8e4f-4cf6-b374-1f49a24cc59b","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-0d877f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"bf218e0e-b023-4f6d-bac6-12e33e872c5c","keyName":"e2e-rate-a-fa4cdd","subscription":"e2e-rate-iso-a-fa4cdd","tenant":"e2e-shared-a-0d877f","userId":"bf218e0e-b023-4f6d-bac6-12e33e872c5c","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T15:01:31Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5f203c89-8e4f-4cf6-b374-1f49a24cc59b","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-0d877f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-0d877f/rate-test-model-0d877f\",\"requestedSubscription\":\"e2e-rate-iso-a-fa4cdd\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T15:01:31Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5f203c89-8e4f-4cf6-b374-1f49a24cc59b","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-0d877f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-0d877f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-fa4cdd","namespace":"ai-tenant-e2e-shared-a-0d877f","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T15:01:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5f203c89-8e4f-4cf6-b374-1f49a24cc59b","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T15:01:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5f203c89-8e4f-4cf6-b374-1f49a24cc59b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:01:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5f203c89-8e4f-4cf6-b374-1f49a24cc59b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:01:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5f203c89-8e4f-4cf6-b374-1f49a24cc59b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-0d877f/rate-test-model-0d877f\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:01:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5f203c89-8e4f-4cf6-b374-1f49a24cc59b","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:01:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5f203c89-8e4f-4cf6-b374-1f49a24cc59b","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T15:01:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5f203c89-8e4f-4cf6-b374-1f49a24cc59b","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-fa4cdd"}
{"level":"debug","ts":"2026-07-09T15:01:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5f203c89-8e4f-4cf6-b374-1f49a24cc59b","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T15:01:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5f203c89-8e4f-4cf6-b374-1f49a24cc59b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"bf218e0e-b023-4f6d-bac6-12e33e872c5c","keyName":"e2e-rate-a-fa4cdd","selected_subscription":"e2e-rate-iso-a-fa4cdd","selected_subscription_key":"ai-tenant-e2e-shared-a-0d877f/e2e-rate-iso-a-fa4cdd@ai-tenant-e2e-shared-a-0d877f/rate-test-model-0d877f","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-0d877f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-fa4cdd","namespace":"ai-tenant-e2e-shared-a-0d877f","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T15:01:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5f203c89-8e4f-4cf6-b374-1f49a24cc59b","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T15:01:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5f203c89-8e4f-4cf6-b374-1f49a24cc59b","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T15:01:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2e6153b3-ecfb-4f56-8ff3-75f4a3137fe2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:54986","PortSpecifier":{"PortValue":54986}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.65:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2e6153b3-ecfb-4f56-8ff3-75f4a3137fe2","method":"POST","path":"/ai-tenant-e2e-shared-a-0d877f/rate-test-model-0d877f/v1/completions","host":"e2e-shared-a-0d877f.apps.7bfc212a-a32c-41f1-9546-498d5ebffd32.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T15:01:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2e6153b3-ecfb-4f56-8ff3-75f4a3137fe2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:54986","PortSpecifier":{"PortValue":54986}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.65:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783609292,"nanos":929130268},"http":{"id":"2e6153b3-ecfb-4f56-8ff3-75f4a3137fe2","method":"POST","headers":{":authority":"e2e-shared-a-0d877f.apps.7bfc212a-a32c-41f1-9546-498d5ebffd32.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-0d877f/rate-test-model-0d877f/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T15:01:32Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2e6153b3-ecfb-4f56-8ff3-75f4a3137fe2","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1W7j25YP51JxbCG5y_dkcpEIIW3L8QVucTbbKiHN6t2M9PrS8OfUCLEpyroVx"}
{"level":"debug","ts":"2026-07-09T15:01:32Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2e6153b3-ecfb-4f56-8ff3-75f4a3137fe2","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-0d877f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1W7j25YP51JxbCG5y_dkcpEIIW3L8QVucTbbKiHN6t2M9PrS8OfUCLEpyroVx\"}"}
{"level":"debug","ts":"2026-07-09T15:01:32Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2e6153b3-ecfb-4f56-8ff3-75f4a3137fe2","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-0d877f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"bf218e0e-b023-4f6d-bac6-12e33e872c5c","keyName":"e2e-rate-a-fa4cdd","subscription":"e2e-rate-iso-a-fa4cdd","tenant":"e2e-shared-a-0d877f","userId":"bf218e0e-b023-4f6d-bac6-12e33e872c5c","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T15:01:32Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2e6153b3-ecfb-4f56-8ff3-75f4a3137fe2","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-0d877f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-0d877f/rate-test-model-0d877f\",\"requestedSubscription\":\"e2e-rate-iso-a-fa4cdd\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T15:01:32Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2e6153b3-ecfb-4f56-8ff3-75f4a3137fe2","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-0d877f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-0d877f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-fa4cdd","namespace":"ai-tenant-e2e-shared-a-0d877f","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T15:01:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2e6153b3-ecfb-4f56-8ff3-75f4a3137fe2","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T15:01:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2e6153b3-ecfb-4f56-8ff3-75f4a3137fe2","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:01:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2e6153b3-ecfb-4f56-8ff3-75f4a3137fe2","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:01:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2e6153b3-ecfb-4f56-8ff3-75f4a3137fe2","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-0d877f/rate-test-model-0d877f\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:01:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2e6153b3-ecfb-4f56-8ff3-75f4a3137fe2","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:01:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2e6153b3-ecfb-4f56-8ff3-75f4a3137fe2","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T15:01:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2e6153b3-ecfb-4f56-8ff3-75f4a3137fe2","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T15:01:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2e6153b3-ecfb-4f56-8ff3-75f4a3137fe2","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-fa4cdd"}
{"level":"debug","ts":"2026-07-09T15:01:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2e6153b3-ecfb-4f56-8ff3-75f4a3137fe2","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"bf218e0e-b023-4f6d-bac6-12e33e872c5c","keyName":"e2e-rate-a-fa4cdd","selected_subscription":"e2e-rate-iso-a-fa4cdd","selected_subscription_key":"ai-tenant-e2e-shared-a-0d877f/e2e-rate-iso-a-fa4cdd@ai-tenant-e2e-shared-a-0d877f/rate-test-model-0d877f","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-0d877f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-fa4cdd","namespace":"ai-tenant-e2e-shared-a-0d877f","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T15:01:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2e6153b3-ecfb-4f56-8ff3-75f4a3137fe2","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T15:01:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2e6153b3-ecfb-4f56-8ff3-75f4a3137fe2","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T15:01:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3783ac80-fe8b-40dc-8da7-247e335561b9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:54994","PortSpecifier":{"PortValue":54994}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.65:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3783ac80-fe8b-40dc-8da7-247e335561b9","method":"POST","path":"/ai-tenant-e2e-shared-a-0d877f/rate-test-model-0d877f/v1/completions","host":"e2e-shared-a-0d877f.apps.7bfc212a-a32c-41f1-9546-498d5ebffd32.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T15:01:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3783ac80-fe8b-40dc-8da7-247e335561b9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:54994","PortSpecifier":{"PortValue":54994}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.65:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783609293,"nanos":969829719},"http":{"id":"3783ac80-fe8b-40dc-8da7-247e335561b9","method":"POST","headers":{":authority":"e2e-shared-a-0d877f.apps.7bfc212a-a32c-41f1-9546-498d5ebffd32.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-0d877f/rate-test-model-0d877f/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T15:01:33Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3783ac80-fe8b-40dc-8da7-247e335561b9","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1W7j25YP51JxbCG5y_dkcpEIIW3L8QVucTbbKiHN6t2M9PrS8OfUCLEpyroVx"}
{"level":"debug","ts":"2026-07-09T15:01:33Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3783ac80-fe8b-40dc-8da7-247e335561b9","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-0d877f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1W7j25YP51JxbCG5y_dkcpEIIW3L8QVucTbbKiHN6t2M9PrS8OfUCLEpyroVx\"}"}
{"level":"debug","ts":"2026-07-09T15:01:33Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3783ac80-fe8b-40dc-8da7-247e335561b9","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-0d877f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"bf218e0e-b023-4f6d-bac6-12e33e872c5c","keyName":"e2e-rate-a-fa4cdd","subscription":"e2e-rate-iso-a-fa4cdd","tenant":"e2e-shared-a-0d877f","userId":"bf218e0e-b023-4f6d-bac6-12e33e872c5c","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T15:01:33Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3783ac80-fe8b-40dc-8da7-247e335561b9","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-0d877f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-0d877f/rate-test-model-0d877f\",\"requestedSubscription\":\"e2e-rate-iso-a-fa4cdd\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T15:01:33Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3783ac80-fe8b-40dc-8da7-247e335561b9","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-0d877f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-0d877f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-fa4cdd","namespace":"ai-tenant-e2e-shared-a-0d877f","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T15:01:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3783ac80-fe8b-40dc-8da7-247e335561b9","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T15:01:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3783ac80-fe8b-40dc-8da7-247e335561b9","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:01:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3783ac80-fe8b-40dc-8da7-247e335561b9","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:01:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3783ac80-fe8b-40dc-8da7-247e335561b9","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:01:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3783ac80-fe8b-40dc-8da7-247e335561b9","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-0d877f/rate-test-model-0d877f\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:01:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3783ac80-fe8b-40dc-8da7-247e335561b9","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T15:01:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3783ac80-fe8b-40dc-8da7-247e335561b9","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-fa4cdd"}
{"level":"debug","ts":"2026-07-09T15:01:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3783ac80-fe8b-40dc-8da7-247e335561b9","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T15:01:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3783ac80-fe8b-40dc-8da7-247e335561b9","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"bf218e0e-b023-4f6d-bac6-12e33e872c5c","keyName":"e2e-rate-a-fa4cdd","selected_subscription":"e2e-rate-iso-a-fa4cdd","selected_subscription_key":"ai-tenant-e2e-shared-a-0d877f/e2e-rate-iso-a-fa4cdd@ai-tenant-e2e-shared-a-0d877f/rate-test-model-0d877f","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-0d877f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-fa4cdd","namespace":"ai-tenant-e2e-shared-a-0d877f","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T15:01:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3783ac80-fe8b-40dc-8da7-247e335561b9","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T15:01:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3783ac80-fe8b-40dc-8da7-247e335561b9","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T15:01:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d1dda53b-a9c9-44ef-a700-2252c4a50abe","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:53410","PortSpecifier":{"PortValue":53410}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.65:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d1dda53b-a9c9-44ef-a700-2252c4a50abe","method":"POST","path":"/ai-tenant-e2e-shared-a-0d877f/rate-test-model-0d877f/v1/completions","host":"e2e-shared-a-0d877f.apps.7bfc212a-a32c-41f1-9546-498d5ebffd32.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T15:01:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d1dda53b-a9c9-44ef-a700-2252c4a50abe","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:53410","PortSpecifier":{"PortValue":53410}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.65:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783609295,"nanos":10951971},"http":{"id":"d1dda53b-a9c9-44ef-a700-2252c4a50abe","method":"POST","headers":{":authority":"e2e-shared-a-0d877f.apps.7bfc212a-a32c-41f1-9546-498d5ebffd32.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-0d877f/rate-test-model-0d877f/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T15:01:35Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d1dda53b-a9c9-44ef-a700-2252c4a50abe","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1W7j25YP51JxbCG5y_dkcpEIIW3L8QVucTbbKiHN6t2M9PrS8OfUCLEpyroVx"}
{"level":"debug","ts":"2026-07-09T15:01:35Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d1dda53b-a9c9-44ef-a700-2252c4a50abe","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-0d877f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1W7j25YP51JxbCG5y_dkcpEIIW3L8QVucTbbKiHN6t2M9PrS8OfUCLEpyroVx\"}"}
{"level":"debug","ts":"2026-07-09T15:01:35Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d1dda53b-a9c9-44ef-a700-2252c4a50abe","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-0d877f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"bf218e0e-b023-4f6d-bac6-12e33e872c5c","keyName":"e2e-rate-a-fa4cdd","subscription":"e2e-rate-iso-a-fa4cdd","tenant":"e2e-shared-a-0d877f","userId":"bf218e0e-b023-4f6d-bac6-12e33e872c5c","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T15:01:35Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d1dda53b-a9c9-44ef-a700-2252c4a50abe","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-0d877f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-0d877f/rate-test-model-0d877f\",\"requestedSubscription\":\"e2e-rate-iso-a-fa4cdd\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T15:01:35Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d1dda53b-a9c9-44ef-a700-2252c4a50abe","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-0d877f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-0d877f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-fa4cdd","namespace":"ai-tenant-e2e-shared-a-0d877f","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T15:01:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d1dda53b-a9c9-44ef-a700-2252c4a50abe","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T15:01:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d1dda53b-a9c9-44ef-a700-2252c4a50abe","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:01:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d1dda53b-a9c9-44ef-a700-2252c4a50abe","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:01:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d1dda53b-a9c9-44ef-a700-2252c4a50abe","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-0d877f/rate-test-model-0d877f\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:01:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d1dda53b-a9c9-44ef-a700-2252c4a50abe","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:01:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d1dda53b-a9c9-44ef-a700-2252c4a50abe","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T15:01:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d1dda53b-a9c9-44ef-a700-2252c4a50abe","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-fa4cdd"}
{"level":"debug","ts":"2026-07-09T15:01:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d1dda53b-a9c9-44ef-a700-2252c4a50abe","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T15:01:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d1dda53b-a9c9-44ef-a700-2252c4a50abe","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"bf218e0e-b023-4f6d-bac6-12e33e872c5c","keyName":"e2e-rate-a-fa4cdd","selected_subscription":"e2e-rate-iso-a-fa4cdd","selected_subscription_key":"ai-tenant-e2e-shared-a-0d877f/e2e-rate-iso-a-fa4cdd@ai-tenant-e2e-shared-a-0d877f/rate-test-model-0d877f","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-0d877f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-fa4cdd","namespace":"ai-tenant-e2e-shared-a-0d877f","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T15:01:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d1dda53b-a9c9-44ef-a700-2252c4a50abe","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T15:01:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d1dda53b-a9c9-44ef-a700-2252c4a50abe","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T15:01:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"da0fe8e7-1520-4b83-a210-452117d41bf2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:53422","PortSpecifier":{"PortValue":53422}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.65:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"da0fe8e7-1520-4b83-a210-452117d41bf2","method":"POST","path":"/ai-tenant-e2e-shared-a-0d877f/rate-test-model-0d877f/v1/completions","host":"e2e-shared-a-0d877f.apps.7bfc212a-a32c-41f1-9546-498d5ebffd32.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T15:01:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"da0fe8e7-1520-4b83-a210-452117d41bf2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:53422","PortSpecifier":{"PortValue":53422}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.65:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783609296,"nanos":47988815},"http":{"id":"da0fe8e7-1520-4b83-a210-452117d41bf2","method":"POST","headers":{":authority":"e2e-shared-a-0d877f.apps.7bfc212a-a32c-41f1-9546-498d5ebffd32.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-0d877f/rate-test-model-0d877f/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T15:01:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"da0fe8e7-1520-4b83-a210-452117d41bf2","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1W7j25YP51JxbCG5y_dkcpEIIW3L8QVucTbbKiHN6t2M9PrS8OfUCLEpyroVx"}
{"level":"debug","ts":"2026-07-09T15:01:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"da0fe8e7-1520-4b83-a210-452117d41bf2","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-0d877f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1W7j25YP51JxbCG5y_dkcpEIIW3L8QVucTbbKiHN6t2M9PrS8OfUCLEpyroVx\"}"}
{"level":"debug","ts":"2026-07-09T15:01:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"da0fe8e7-1520-4b83-a210-452117d41bf2","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-0d877f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"bf218e0e-b023-4f6d-bac6-12e33e872c5c","keyName":"e2e-rate-a-fa4cdd","subscription":"e2e-rate-iso-a-fa4cdd","tenant":"e2e-shared-a-0d877f","userId":"bf218e0e-b023-4f6d-bac6-12e33e872c5c","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T15:01:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"da0fe8e7-1520-4b83-a210-452117d41bf2","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-0d877f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-0d877f/rate-test-model-0d877f\",\"requestedSubscription\":\"e2e-rate-iso-a-fa4cdd\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T15:01:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"da0fe8e7-1520-4b83-a210-452117d41bf2","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-0d877f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-0d877f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-fa4cdd","namespace":"ai-tenant-e2e-shared-a-0d877f","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T15:01:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"da0fe8e7-1520-4b83-a210-452117d41bf2","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T15:01:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"da0fe8e7-1520-4b83-a210-452117d41bf2","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:01:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"da0fe8e7-1520-4b83-a210-452117d41bf2","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:01:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"da0fe8e7-1520-4b83-a210-452117d41bf2","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-0d877f/rate-test-model-0d877f\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:01:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"da0fe8e7-1520-4b83-a210-452117d41bf2","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:01:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"da0fe8e7-1520-4b83-a210-452117d41bf2","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T15:01:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"da0fe8e7-1520-4b83-a210-452117d41bf2","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-fa4cdd"}
{"level":"debug","ts":"2026-07-09T15:01:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"da0fe8e7-1520-4b83-a210-452117d41bf2","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T15:01:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"da0fe8e7-1520-4b83-a210-452117d41bf2","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"bf218e0e-b023-4f6d-bac6-12e33e872c5c","keyName":"e2e-rate-a-fa4cdd","selected_subscription":"e2e-rate-iso-a-fa4cdd","selected_subscription_key":"ai-tenant-e2e-shared-a-0d877f/e2e-rate-iso-a-fa4cdd@ai-tenant-e2e-shared-a-0d877f/rate-test-model-0d877f","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-0d877f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-fa4cdd","namespace":"ai-tenant-e2e-shared-a-0d877f","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T15:01:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"da0fe8e7-1520-4b83-a210-452117d41bf2","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T15:01:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"da0fe8e7-1520-4b83-a210-452117d41bf2","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T15:01:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"43aaf666-1fa6-4978-8206-8830dcbca4b1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:53436","PortSpecifier":{"PortValue":53436}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.65:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"43aaf666-1fa6-4978-8206-8830dcbca4b1","method":"POST","path":"/ai-tenant-e2e-shared-a-0d877f/rate-test-model-0d877f/v1/completions","host":"e2e-shared-a-0d877f.apps.7bfc212a-a32c-41f1-9546-498d5ebffd32.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T15:01:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"43aaf666-1fa6-4978-8206-8830dcbca4b1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:53436","PortSpecifier":{"PortValue":53436}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.65:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783609297,"nanos":85605082},"http":{"id":"43aaf666-1fa6-4978-8206-8830dcbca4b1","method":"POST","headers":{":authority":"e2e-shared-a-0d877f.apps.7bfc212a-a32c-41f1-9546-498d5ebffd32.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-0d877f/rate-test-model-0d877f/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T15:01:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"43aaf666-1fa6-4978-8206-8830dcbca4b1","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1W7j25YP51JxbCG5y_dkcpEIIW3L8QVucTbbKiHN6t2M9PrS8OfUCLEpyroVx"}
{"level":"debug","ts":"2026-07-09T15:01:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"43aaf666-1fa6-4978-8206-8830dcbca4b1","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-0d877f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1W7j25YP51JxbCG5y_dkcpEIIW3L8QVucTbbKiHN6t2M9PrS8OfUCLEpyroVx\"}"}
{"level":"debug","ts":"2026-07-09T15:01:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"43aaf666-1fa6-4978-8206-8830dcbca4b1","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-0d877f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"bf218e0e-b023-4f6d-bac6-12e33e872c5c","keyName":"e2e-rate-a-fa4cdd","subscription":"e2e-rate-iso-a-fa4cdd","tenant":"e2e-shared-a-0d877f","userId":"bf218e0e-b023-4f6d-bac6-12e33e872c5c","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T15:01:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"43aaf666-1fa6-4978-8206-8830dcbca4b1","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-0d877f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-0d877f/rate-test-model-0d877f\",\"requestedSubscription\":\"e2e-rate-iso-a-fa4cdd\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T15:01:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"43aaf666-1fa6-4978-8206-8830dcbca4b1","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-0d877f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-0d877f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-fa4cdd","namespace":"ai-tenant-e2e-shared-a-0d877f","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T15:01:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"43aaf666-1fa6-4978-8206-8830dcbca4b1","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T15:01:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"43aaf666-1fa6-4978-8206-8830dcbca4b1","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:01:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"43aaf666-1fa6-4978-8206-8830dcbca4b1","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:01:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"43aaf666-1fa6-4978-8206-8830dcbca4b1","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-0d877f/rate-test-model-0d877f\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:01:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"43aaf666-1fa6-4978-8206-8830dcbca4b1","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:01:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"43aaf666-1fa6-4978-8206-8830dcbca4b1","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T15:01:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"43aaf666-1fa6-4978-8206-8830dcbca4b1","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-fa4cdd"}
{"level":"debug","ts":"2026-07-09T15:01:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"43aaf666-1fa6-4978-8206-8830dcbca4b1","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T15:01:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"43aaf666-1fa6-4978-8206-8830dcbca4b1","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"bf218e0e-b023-4f6d-bac6-12e33e872c5c","keyName":"e2e-rate-a-fa4cdd","selected_subscription":"e2e-rate-iso-a-fa4cdd","selected_subscription_key":"ai-tenant-e2e-shared-a-0d877f/e2e-rate-iso-a-fa4cdd@ai-tenant-e2e-shared-a-0d877f/rate-test-model-0d877f","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-0d877f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-fa4cdd","namespace":"ai-tenant-e2e-shared-a-0d877f","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T15:01:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"43aaf666-1fa6-4978-8206-8830dcbca4b1","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T15:01:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"43aaf666-1fa6-4978-8206-8830dcbca4b1","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T15:01:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8cc3ca23-9708-4a34-abcb-a758afd6540f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:53450","PortSpecifier":{"PortValue":53450}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.65:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"8cc3ca23-9708-4a34-abcb-a758afd6540f","method":"POST","path":"/ai-tenant-e2e-shared-a-0d877f/rate-test-model-0d877f/v1/completions","host":"e2e-shared-a-0d877f.apps.7bfc212a-a32c-41f1-9546-498d5ebffd32.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T15:01:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8cc3ca23-9708-4a34-abcb-a758afd6540f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:53450","PortSpecifier":{"PortValue":53450}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.65:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783609298,"nanos":124348206},"http":{"id":"8cc3ca23-9708-4a34-abcb-a758afd6540f","method":"POST","headers":{":authority":"e2e-shared-a-0d877f.apps.7bfc212a-a32c-41f1-9546-498d5ebffd32.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-0d877f/rate-test-model-0d877f/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T15:01:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"8cc3ca23-9708-4a34-abcb-a758afd6540f","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1W7j25YP51JxbCG5y_dkcpEIIW3L8QVucTbbKiHN6t2M9PrS8OfUCLEpyroVx"}
{"level":"debug","ts":"2026-07-09T15:01:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"8cc3ca23-9708-4a34-abcb-a758afd6540f","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-0d877f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1W7j25YP51JxbCG5y_dkcpEIIW3L8QVucTbbKiHN6t2M9PrS8OfUCLEpyroVx\"}"}
{"level":"debug","ts":"2026-07-09T15:01:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"8cc3ca23-9708-4a34-abcb-a758afd6540f","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-0d877f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"bf218e0e-b023-4f6d-bac6-12e33e872c5c","keyName":"e2e-rate-a-fa4cdd","subscription":"e2e-rate-iso-a-fa4cdd","tenant":"e2e-shared-a-0d877f","userId":"bf218e0e-b023-4f6d-bac6-12e33e872c5c","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T15:01:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"8cc3ca23-9708-4a34-abcb-a758afd6540f","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-0d877f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-0d877f/rate-test-model-0d877f\",\"requestedSubscription\":\"e2e-rate-iso-a-fa4cdd\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T15:01:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"8cc3ca23-9708-4a34-abcb-a758afd6540f","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-0d877f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-0d877f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-fa4cdd","namespace":"ai-tenant-e2e-shared-a-0d877f","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T15:01:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"8cc3ca23-9708-4a34-abcb-a758afd6540f","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T15:01:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8cc3ca23-9708-4a34-abcb-a758afd6540f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:01:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8cc3ca23-9708-4a34-abcb-a758afd6540f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:01:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8cc3ca23-9708-4a34-abcb-a758afd6540f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-0d877f/rate-test-model-0d877f\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:01:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8cc3ca23-9708-4a34-abcb-a758afd6540f","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:01:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8cc3ca23-9708-4a34-abcb-a758afd6540f","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T15:01:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8cc3ca23-9708-4a34-abcb-a758afd6540f","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T15:01:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8cc3ca23-9708-4a34-abcb-a758afd6540f","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-fa4cdd"}
{"level":"debug","ts":"2026-07-09T15:01:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8cc3ca23-9708-4a34-abcb-a758afd6540f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"bf218e0e-b023-4f6d-bac6-12e33e872c5c","keyName":"e2e-rate-a-fa4cdd","selected_subscription":"e2e-rate-iso-a-fa4cdd","selected_subscription_key":"ai-tenant-e2e-shared-a-0d877f/e2e-rate-iso-a-fa4cdd@ai-tenant-e2e-shared-a-0d877f/rate-test-model-0d877f","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-0d877f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-fa4cdd","namespace":"ai-tenant-e2e-shared-a-0d877f","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T15:01:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8cc3ca23-9708-4a34-abcb-a758afd6540f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T15:01:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8cc3ca23-9708-4a34-abcb-a758afd6540f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T15:01:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"77f4b88a-8db0-4a8f-adb6-7b2b347ccd6e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:53458","PortSpecifier":{"PortValue":53458}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.65:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"77f4b88a-8db0-4a8f-adb6-7b2b347ccd6e","method":"POST","path":"/ai-tenant-e2e-shared-a-0d877f/rate-test-model-0d877f/v1/completions","host":"e2e-shared-a-0d877f.apps.7bfc212a-a32c-41f1-9546-498d5ebffd32.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T15:01:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"77f4b88a-8db0-4a8f-adb6-7b2b347ccd6e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:53458","PortSpecifier":{"PortValue":53458}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.65:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783609299,"nanos":160608265},"http":{"id":"77f4b88a-8db0-4a8f-adb6-7b2b347ccd6e","method":"POST","headers":{":authority":"e2e-shared-a-0d877f.apps.7bfc212a-a32c-41f1-9546-498d5ebffd32.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-0d877f/rate-test-model-0d877f/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T15:01:39Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"77f4b88a-8db0-4a8f-adb6-7b2b347ccd6e","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1W7j25YP51JxbCG5y_dkcpEIIW3L8QVucTbbKiHN6t2M9PrS8OfUCLEpyroVx"}
{"level":"debug","ts":"2026-07-09T15:01:39Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"77f4b88a-8db0-4a8f-adb6-7b2b347ccd6e","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-0d877f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1W7j25YP51JxbCG5y_dkcpEIIW3L8QVucTbbKiHN6t2M9PrS8OfUCLEpyroVx\"}"}
{"level":"debug","ts":"2026-07-09T15:01:39Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"77f4b88a-8db0-4a8f-adb6-7b2b347ccd6e","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-0d877f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"bf218e0e-b023-4f6d-bac6-12e33e872c5c","keyName":"e2e-rate-a-fa4cdd","subscription":"e2e-rate-iso-a-fa4cdd","tenant":"e2e-shared-a-0d877f","userId":"bf218e0e-b023-4f6d-bac6-12e33e872c5c","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T15:01:39Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"77f4b88a-8db0-4a8f-adb6-7b2b347ccd6e","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-0d877f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-0d877f/rate-test-model-0d877f\",\"requestedSubscription\":\"e2e-rate-iso-a-fa4cdd\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T15:01:39Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"77f4b88a-8db0-4a8f-adb6-7b2b347ccd6e","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-0d877f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-0d877f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-fa4cdd","namespace":"ai-tenant-e2e-shared-a-0d877f","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T15:01:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"77f4b88a-8db0-4a8f-adb6-7b2b347ccd6e","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T15:01:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"77f4b88a-8db0-4a8f-adb6-7b2b347ccd6e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:01:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"77f4b88a-8db0-4a8f-adb6-7b2b347ccd6e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:01:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"77f4b88a-8db0-4a8f-adb6-7b2b347ccd6e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-0d877f/rate-test-model-0d877f\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:01:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"77f4b88a-8db0-4a8f-adb6-7b2b347ccd6e","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:01:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"77f4b88a-8db0-4a8f-adb6-7b2b347ccd6e","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T15:01:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"77f4b88a-8db0-4a8f-adb6-7b2b347ccd6e","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T15:01:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"77f4b88a-8db0-4a8f-adb6-7b2b347ccd6e","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-fa4cdd"}
{"level":"debug","ts":"2026-07-09T15:01:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"77f4b88a-8db0-4a8f-adb6-7b2b347ccd6e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"bf218e0e-b023-4f6d-bac6-12e33e872c5c","keyName":"e2e-rate-a-fa4cdd","selected_subscription":"e2e-rate-iso-a-fa4cdd","selected_subscription_key":"ai-tenant-e2e-shared-a-0d877f/e2e-rate-iso-a-fa4cdd@ai-tenant-e2e-shared-a-0d877f/rate-test-model-0d877f","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-0d877f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-fa4cdd","namespace":"ai-tenant-e2e-shared-a-0d877f","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T15:01:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"77f4b88a-8db0-4a8f-adb6-7b2b347ccd6e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T15:01:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"77f4b88a-8db0-4a8f-adb6-7b2b347ccd6e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T15:01:40Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0f337ee3-888b-448b-a12c-69fc37378689","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:53464","PortSpecifier":{"PortValue":53464}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.65:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0f337ee3-888b-448b-a12c-69fc37378689","method":"POST","path":"/ai-tenant-e2e-shared-a-0d877f/rate-test-model-0d877f/v1/completions","host":"e2e-shared-a-0d877f.apps.7bfc212a-a32c-41f1-9546-498d5ebffd32.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T15:01:40Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0f337ee3-888b-448b-a12c-69fc37378689","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:53464","PortSpecifier":{"PortValue":53464}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.65:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783609300,"nanos":196653770},"http":{"id":"0f337ee3-888b-448b-a12c-69fc37378689","method":"POST","headers":{":authority":"e2e-shared-a-0d877f.apps.7bfc212a-a32c-41f1-9546-498d5ebffd32.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-0d877f/rate-test-model-0d877f/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T15:01:40Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0f337ee3-888b-448b-a12c-69fc37378689","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1W7j25YP51JxbCG5y_dkcpEIIW3L8QVucTbbKiHN6t2M9PrS8OfUCLEpyroVx"}
{"level":"debug","ts":"2026-07-09T15:01:40Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0f337ee3-888b-448b-a12c-69fc37378689","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-0d877f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1W7j25YP51JxbCG5y_dkcpEIIW3L8QVucTbbKiHN6t2M9PrS8OfUCLEpyroVx\"}"}
{"level":"debug","ts":"2026-07-09T15:01:40Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0f337ee3-888b-448b-a12c-69fc37378689","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-0d877f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"bf218e0e-b023-4f6d-bac6-12e33e872c5c","keyName":"e2e-rate-a-fa4cdd","subscription":"e2e-rate-iso-a-fa4cdd","tenant":"e2e-shared-a-0d877f","userId":"bf218e0e-b023-4f6d-bac6-12e33e872c5c","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T15:01:40Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0f337ee3-888b-448b-a12c-69fc37378689","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-0d877f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-0d877f/rate-test-model-0d877f\",\"requestedSubscription\":\"e2e-rate-iso-a-fa4cdd\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T15:01:40Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0f337ee3-888b-448b-a12c-69fc37378689","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-0d877f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-0d877f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-fa4cdd","namespace":"ai-tenant-e2e-shared-a-0d877f","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T15:01:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0f337ee3-888b-448b-a12c-69fc37378689","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T15:01:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0f337ee3-888b-448b-a12c-69fc37378689","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:01:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0f337ee3-888b-448b-a12c-69fc37378689","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:01:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0f337ee3-888b-448b-a12c-69fc37378689","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:01:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0f337ee3-888b-448b-a12c-69fc37378689","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-0d877f/rate-test-model-0d877f\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:01:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0f337ee3-888b-448b-a12c-69fc37378689","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T15:01:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0f337ee3-888b-448b-a12c-69fc37378689","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-fa4cdd"}
{"level":"debug","ts":"2026-07-09T15:01:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0f337ee3-888b-448b-a12c-69fc37378689","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T15:01:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0f337ee3-888b-448b-a12c-69fc37378689","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"bf218e0e-b023-4f6d-bac6-12e33e872c5c","keyName":"e2e-rate-a-fa4cdd","selected_subscription":"e2e-rate-iso-a-fa4cdd","selected_subscription_key":"ai-tenant-e2e-shared-a-0d877f/e2e-rate-iso-a-fa4cdd@ai-tenant-e2e-shared-a-0d877f/rate-test-model-0d877f","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-0d877f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-fa4cdd","namespace":"ai-tenant-e2e-shared-a-0d877f","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T15:01:40Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0f337ee3-888b-448b-a12c-69fc37378689","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T15:01:40Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0f337ee3-888b-448b-a12c-69fc37378689","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T15:01:40Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b5a67bc2-658d-4bdb-affd-de00ad4cb264","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:48454","PortSpecifier":{"PortValue":48454}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.67:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b5a67bc2-658d-4bdb-affd-de00ad4cb264","method":"POST","path":"/ai-tenant-e2e-shared-b-d74e21/rate-test-model-d74e21/v1/completions","host":"e2e-shared-b-d74e21.apps.7bfc212a-a32c-41f1-9546-498d5ebffd32.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T15:01:40Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b5a67bc2-658d-4bdb-affd-de00ad4cb264","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:48454","PortSpecifier":{"PortValue":48454}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.67:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783609300,"nanos":236744605},"http":{"id":"b5a67bc2-658d-4bdb-affd-de00ad4cb264","method":"POST","headers":{":authority":"e2e-shared-b-d74e21.apps.7bfc212a-a32c-41f1-9546-498d5ebffd32.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-d74e21/rate-test-model-d74e21/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T15:01:40Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b5a67bc2-658d-4bdb-affd-de00ad4cb264","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-YcZt9gsO4JwTN1Aj_KbIEJztnL7vaqnt5bSk5pHKM3fI8OW79WAhXGyoBZa"}
{"level":"debug","ts":"2026-07-09T15:01:40Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b5a67bc2-658d-4bdb-affd-de00ad4cb264","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-d74e21.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-YcZt9gsO4JwTN1Aj_KbIEJztnL7vaqnt5bSk5pHKM3fI8OW79WAhXGyoBZa\"}"}
{"level":"debug","ts":"2026-07-09T15:01:40Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b5a67bc2-658d-4bdb-affd-de00ad4cb264","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-d74e21.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"5741cbf7-3f7e-4968-be84-32c8537ab3bc","keyName":"e2e-rate-b-fa4cdd","subscription":"e2e-rate-iso-b-fa4cdd","tenant":"e2e-shared-b-d74e21","userId":"5741cbf7-3f7e-4968-be84-32c8537ab3bc","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T15:01:40Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b5a67bc2-658d-4bdb-affd-de00ad4cb264","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-d74e21.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-d74e21/rate-test-model-d74e21\",\"requestedSubscription\":\"e2e-rate-iso-b-fa4cdd\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T15:01:40Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b5a67bc2-658d-4bdb-affd-de00ad4cb264","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-d74e21.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-d74e21","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-fa4cdd","namespace":"ai-tenant-e2e-shared-b-d74e21","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T15:01:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b5a67bc2-658d-4bdb-affd-de00ad4cb264","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T15:01:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b5a67bc2-658d-4bdb-affd-de00ad4cb264","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:01:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b5a67bc2-658d-4bdb-affd-de00ad4cb264","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:01:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b5a67bc2-658d-4bdb-affd-de00ad4cb264","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-d74e21/rate-test-model-d74e21\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:01:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b5a67bc2-658d-4bdb-affd-de00ad4cb264","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:01:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b5a67bc2-658d-4bdb-affd-de00ad4cb264","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T15:01:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b5a67bc2-658d-4bdb-affd-de00ad4cb264","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T15:01:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b5a67bc2-658d-4bdb-affd-de00ad4cb264","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-fa4cdd"}
{"level":"debug","ts":"2026-07-09T15:01:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b5a67bc2-658d-4bdb-affd-de00ad4cb264","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"5741cbf7-3f7e-4968-be84-32c8537ab3bc","keyName":"e2e-rate-b-fa4cdd","selected_subscription":"e2e-rate-iso-b-fa4cdd","selected_subscription_key":"ai-tenant-e2e-shared-b-d74e21/e2e-rate-iso-b-fa4cdd@ai-tenant-e2e-shared-b-d74e21/rate-test-model-d74e21","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-d74e21","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-fa4cdd","namespace":"ai-tenant-e2e-shared-b-d74e21","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T15:01:40Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b5a67bc2-658d-4bdb-affd-de00ad4cb264","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T15:01:40Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b5a67bc2-658d-4bdb-affd-de00ad4cb264","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T15:01:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/89b8b158620363d7787a096b2aaad80e4e2515e2d072600b67243d87fc1ddf7b"}
{"level":"info","ts":"2026-07-09T15:01:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1ab2dec9ff9ffdfebad990e8bfc14f54f1cefb6115b19bbafc57eb010093b877"}
{"level":"info","ts":"2026-07-09T15:01:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ed6949d5063aea803d8960fe22aa918b125c1ff9f56dbb81bc44671c3a7a0373"}
{"level":"info","ts":"2026-07-09T15:01:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2f12ea4bd8abd60734067c4c880f7528118ba1488e181b1c470c772e18ded3f9"}
{"level":"info","ts":"2026-07-09T15:01:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4511cdb38e9d440abc94958a74512fce37d61afe8708088d8ccc44d1ab896abe"}
{"level":"info","ts":"2026-07-09T15:01:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7e838e5b498dea8d021cf9c8efb81af65617a5ab1dda8c85ce5c043942cbb068"}
{"level":"info","ts":"2026-07-09T15:01:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d2d354ee4d5545791d0c57b3b9334a0aa3d59628488b6b8714bd934b344892e8"}
{"level":"info","ts":"2026-07-09T15:01:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f1d10cf66d5a68d1997c8846eb716abeab20021fdba26d3ecaf69f023dd100f8"}
{"level":"info","ts":"2026-07-09T15:01:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7b28b6270385ada1b9c1c374fd8768314faa2e3c3b67680dd43fc995b7388d21"}
{"level":"info","ts":"2026-07-09T15:01:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/97953c07b1b30bfa8b25e03fd7241b4a190b48bd867fdf0838c7be52e809f837"}
{"level":"info","ts":"2026-07-09T15:01:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/82f55224f7a6ab83e008ca7097440e9dcffb6b11a4b9e25440bfe544ad1a64f7"}
{"level":"info","ts":"2026-07-09T15:01:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a035feb8bcd3de39fbdcb30a0220b60306b37df7e930b282aea1d96f8efd7374"}
{"level":"info","ts":"2026-07-09T15:01:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4f59c1972fde4dcbf127a4adea70aa36214364a38b42b96966d6a79ff67a05a1"}
{"level":"info","ts":"2026-07-09T15:01:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c56f4ecba0d7dbfac9848516507f899a56dd63d2a8c3bf6582b8d8735f151287"}
{"level":"info","ts":"2026-07-09T15:01:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b6bb901368300e03918d1defbcf1831459ac474ac7b1d8eb22d200ffa2e57466"}
{"level":"info","ts":"2026-07-09T15:01:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/fda74c5da2375ee23f9607201be7ec4c274402c0714bf6808ca2d4257ba949c8"}
{"level":"info","ts":"2026-07-09T15:02:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/94cb06f9357505c917cf287420967bf9d136b0690405d3cccf947ef4fa58ed25"}
{"level":"info","ts":"2026-07-09T15:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/bde2c31a1bd828cc7c8980b79b34281f13bc2762e0c1caac072690fdfc72a073"}
{"level":"info","ts":"2026-07-09T15:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f6f46892be05920960366a750f3d311c41c1fb821b974ec05d8b10a565227327"}
{"level":"info","ts":"2026-07-09T15:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e3c30dafee927cdef7bb60052e9b6714d9664905800ee0dbd3806d4190bb123a"}
{"level":"info","ts":"2026-07-09T15:02:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/05a04e6df5c8ae35aec22ee4f1adaf00168aa70b6d35a848089ffdf8ee9ce3a7"}
{"level":"info","ts":"2026-07-09T15:02:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c159953242248310e98654787c6aa1d788bf6639b45bdf1b8ddb61ea202ed53f"}
{"level":"info","ts":"2026-07-09T15:02:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/627ec91befe174e25c1d3a1a17e5abe30c74aecfcefcf288832663df6f071606"}
{"level":"info","ts":"2026-07-09T15:02:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b130ceb3d2b2493de0737cbf4d94821a67f603725759b7590893daec5e5938f1"}