{"level":"debug","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6ce6b40092bfb7b9cdf870df11fa9eaef91cebaeab01e2ce5b4ff53225f1921b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T21:45:27Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T21:45:27Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6ce6b40092bfb7b9cdf870df11fa9eaef91cebaeab01e2ce5b4ff53225f1921b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6ce6b40092bfb7b9cdf870df11fa9eaef91cebaeab01e2ce5b4ff53225f1921b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6ce6b40092bfb7b9cdf870df11fa9eaef91cebaeab01e2ce5b4ff53225f1921b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6ce6b40092bfb7b9cdf870df11fa9eaef91cebaeab01e2ce5b4ff53225f1921b"}
{"level":"debug","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"137e909fd2601bb3568b5ec3419be4abf2178f7e458dc310c35bf77b72b246f8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T21:45:27Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T21:45:27Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6ce6b40092bfb7b9cdf870df11fa9eaef91cebaeab01e2ce5b4ff53225f1921b"}
{"level":"info","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"137e909fd2601bb3568b5ec3419be4abf2178f7e458dc310c35bf77b72b246f8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6ce6b40092bfb7b9cdf870df11fa9eaef91cebaeab01e2ce5b4ff53225f1921b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T21:45:27Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T21:45:27Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["6ce6b40092bfb7b9cdf870df11fa9eaef91cebaeab01e2ce5b4ff53225f1921b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/137e909fd2601bb3568b5ec3419be4abf2178f7e458dc310c35bf77b72b246f8"}
{"level":"info","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6ce6b40092bfb7b9cdf870df11fa9eaef91cebaeab01e2ce5b4ff53225f1921b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"137e909fd2601bb3568b5ec3419be4abf2178f7e458dc310c35bf77b72b246f8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T21:45:27Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T21:45:27Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"137e909fd2601bb3568b5ec3419be4abf2178f7e458dc310c35bf77b72b246f8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6ce6b40092bfb7b9cdf870df11fa9eaef91cebaeab01e2ce5b4ff53225f1921b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"137e909fd2601bb3568b5ec3419be4abf2178f7e458dc310c35bf77b72b246f8","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/137e909fd2601bb3568b5ec3419be4abf2178f7e458dc310c35bf77b72b246f8"}
{"level":"debug","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"137e909fd2601bb3568b5ec3419be4abf2178f7e458dc310c35bf77b72b246f8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T21:45:27Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T21:45:27Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["137e909fd2601bb3568b5ec3419be4abf2178f7e458dc310c35bf77b72b246f8"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"137e909fd2601bb3568b5ec3419be4abf2178f7e458dc310c35bf77b72b246f8","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6ce6b40092bfb7b9cdf870df11fa9eaef91cebaeab01e2ce5b4ff53225f1921b"}
{"level":"debug","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"137e909fd2601bb3568b5ec3419be4abf2178f7e458dc310c35bf77b72b246f8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T21:45:27Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T21:45:27Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"137e909fd2601bb3568b5ec3419be4abf2178f7e458dc310c35bf77b72b246f8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"137e909fd2601bb3568b5ec3419be4abf2178f7e458dc310c35bf77b72b246f8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"137e909fd2601bb3568b5ec3419be4abf2178f7e458dc310c35bf77b72b246f8","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/137e909fd2601bb3568b5ec3419be4abf2178f7e458dc310c35bf77b72b246f8"}
{"level":"debug","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c7b37cd6afbbcea9b7230155a67ac47bfe68b323655bd123358b1171370da43f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T21:45:27Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T21:45:27Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c7b37cd6afbbcea9b7230155a67ac47bfe68b323655bd123358b1171370da43f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"137e909fd2601bb3568b5ec3419be4abf2178f7e458dc310c35bf77b72b246f8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c7b37cd6afbbcea9b7230155a67ac47bfe68b323655bd123358b1171370da43f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c7b37cd6afbbcea9b7230155a67ac47bfe68b323655bd123358b1171370da43f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/137e909fd2601bb3568b5ec3419be4abf2178f7e458dc310c35bf77b72b246f8"}
{"level":"debug","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c7b37cd6afbbcea9b7230155a67ac47bfe68b323655bd123358b1171370da43f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T21:45:27Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T21:45:27Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c7b37cd6afbbcea9b7230155a67ac47bfe68b323655bd123358b1171370da43f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"137e909fd2601bb3568b5ec3419be4abf2178f7e458dc310c35bf77b72b246f8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T21:45:27Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T21:45:27Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["137e909fd2601bb3568b5ec3419be4abf2178f7e458dc310c35bf77b72b246f8"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"137e909fd2601bb3568b5ec3419be4abf2178f7e458dc310c35bf77b72b246f8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c7b37cd6afbbcea9b7230155a67ac47bfe68b323655bd123358b1171370da43f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"137e909fd2601bb3568b5ec3419be4abf2178f7e458dc310c35bf77b72b246f8","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c7b37cd6afbbcea9b7230155a67ac47bfe68b323655bd123358b1171370da43f"}
{"level":"debug","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d92a05080444b32dce0e88225162985df456f526ddd9fa024577ec8700eb258d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T21:45:27Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T21:45:27Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/137e909fd2601bb3568b5ec3419be4abf2178f7e458dc310c35bf77b72b246f8"}
{"level":"info","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d92a05080444b32dce0e88225162985df456f526ddd9fa024577ec8700eb258d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c7b37cd6afbbcea9b7230155a67ac47bfe68b323655bd123358b1171370da43f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d92a05080444b32dce0e88225162985df456f526ddd9fa024577ec8700eb258d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d92a05080444b32dce0e88225162985df456f526ddd9fa024577ec8700eb258d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c7b37cd6afbbcea9b7230155a67ac47bfe68b323655bd123358b1171370da43f"}
{"level":"debug","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d92a05080444b32dce0e88225162985df456f526ddd9fa024577ec8700eb258d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T21:45:27Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T21:45:27Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d92a05080444b32dce0e88225162985df456f526ddd9fa024577ec8700eb258d"}
{"level":"info","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d92a05080444b32dce0e88225162985df456f526ddd9fa024577ec8700eb258d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d92a05080444b32dce0e88225162985df456f526ddd9fa024577ec8700eb258d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T21:45:27Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T21:45:27Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d92a05080444b32dce0e88225162985df456f526ddd9fa024577ec8700eb258d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d92a05080444b32dce0e88225162985df456f526ddd9fa024577ec8700eb258d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d92a05080444b32dce0e88225162985df456f526ddd9fa024577ec8700eb258d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T21:45:27Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T21:45:27Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d92a05080444b32dce0e88225162985df456f526ddd9fa024577ec8700eb258d"}
{"level":"info","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d92a05080444b32dce0e88225162985df456f526ddd9fa024577ec8700eb258d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d92a05080444b32dce0e88225162985df456f526ddd9fa024577ec8700eb258d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d92a05080444b32dce0e88225162985df456f526ddd9fa024577ec8700eb258d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d92a05080444b32dce0e88225162985df456f526ddd9fa024577ec8700eb258d"}
{"level":"debug","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"efdf1904bc2767b639409c069a0d6012a87176ea9cd4d7e6d383245e70adab93","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T21:45:27Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T21:45:27Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"efdf1904bc2767b639409c069a0d6012a87176ea9cd4d7e6d383245e70adab93","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d92a05080444b32dce0e88225162985df456f526ddd9fa024577ec8700eb258d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"efdf1904bc2767b639409c069a0d6012a87176ea9cd4d7e6d383245e70adab93","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"efdf1904bc2767b639409c069a0d6012a87176ea9cd4d7e6d383245e70adab93","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d92a05080444b32dce0e88225162985df456f526ddd9fa024577ec8700eb258d"}
{"level":"debug","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"efdf1904bc2767b639409c069a0d6012a87176ea9cd4d7e6d383245e70adab93","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T21:45:27Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T21:45:27Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/efdf1904bc2767b639409c069a0d6012a87176ea9cd4d7e6d383245e70adab93"}
{"level":"info","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"efdf1904bc2767b639409c069a0d6012a87176ea9cd4d7e6d383245e70adab93","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d92a05080444b32dce0e88225162985df456f526ddd9fa024577ec8700eb258d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T21:45:27Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T21:45:27Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d92a05080444b32dce0e88225162985df456f526ddd9fa024577ec8700eb258d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d92a05080444b32dce0e88225162985df456f526ddd9fa024577ec8700eb258d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"efdf1904bc2767b639409c069a0d6012a87176ea9cd4d7e6d383245e70adab93","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d92a05080444b32dce0e88225162985df456f526ddd9fa024577ec8700eb258d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c7b37cd6afbbcea9b7230155a67ac47bfe68b323655bd123358b1171370da43f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T21:45:27Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T21:45:27Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c7b37cd6afbbcea9b7230155a67ac47bfe68b323655bd123358b1171370da43f"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/efdf1904bc2767b639409c069a0d6012a87176ea9cd4d7e6d383245e70adab93"}
{"level":"info","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c7b37cd6afbbcea9b7230155a67ac47bfe68b323655bd123358b1171370da43f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c7b37cd6afbbcea9b7230155a67ac47bfe68b323655bd123358b1171370da43f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"efdf1904bc2767b639409c069a0d6012a87176ea9cd4d7e6d383245e70adab93","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T21:45:27Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T21:45:27Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["efdf1904bc2767b639409c069a0d6012a87176ea9cd4d7e6d383245e70adab93"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d92a05080444b32dce0e88225162985df456f526ddd9fa024577ec8700eb258d"}
{"level":"info","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"efdf1904bc2767b639409c069a0d6012a87176ea9cd4d7e6d383245e70adab93","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8e1bf902f300790503d4794e894e9cecf53d423625f748fef83ace3a460c4033","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T21:45:27Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T21:45:27Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c7b37cd6afbbcea9b7230155a67ac47bfe68b323655bd123358b1171370da43f"}
{"level":"info","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8e1bf902f300790503d4794e894e9cecf53d423625f748fef83ace3a460c4033","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"efdf1904bc2767b639409c069a0d6012a87176ea9cd4d7e6d383245e70adab93","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8e1bf902f300790503d4794e894e9cecf53d423625f748fef83ace3a460c4033","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T21:45:27Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T21:45:27Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8e1bf902f300790503d4794e894e9cecf53d423625f748fef83ace3a460c4033","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8e1bf902f300790503d4794e894e9cecf53d423625f748fef83ace3a460c4033","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T21:45:27Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T21:45:27Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"8e1bf902f300790503d4794e894e9cecf53d423625f748fef83ace3a460c4033","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"8e1bf902f300790503d4794e894e9cecf53d423625f748fef83ace3a460c4033\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8e1bf902f300790503d4794e894e9cecf53d423625f748fef83ace3a460c4033","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8e1bf902f300790503d4794e894e9cecf53d423625f748fef83ace3a460c4033"}
{"level":"debug","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8e1bf902f300790503d4794e894e9cecf53d423625f748fef83ace3a460c4033","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T21:45:27Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T21:45:27Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8e1bf902f300790503d4794e894e9cecf53d423625f748fef83ace3a460c4033"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/efdf1904bc2767b639409c069a0d6012a87176ea9cd4d7e6d383245e70adab93"}
{"level":"info","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8e1bf902f300790503d4794e894e9cecf53d423625f748fef83ace3a460c4033","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8e1bf902f300790503d4794e894e9cecf53d423625f748fef83ace3a460c4033","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T21:45:27Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T21:45:27Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8e1bf902f300790503d4794e894e9cecf53d423625f748fef83ace3a460c4033"}
{"level":"info","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8e1bf902f300790503d4794e894e9cecf53d423625f748fef83ace3a460c4033"}
{"level":"info","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8e1bf902f300790503d4794e894e9cecf53d423625f748fef83ace3a460c4033","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c6d9f28f619f2cbc796cf005a7c24a188aa6fb42151d34233addf55d07fe142e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T21:45:27Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T21:45:27Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c6d9f28f619f2cbc796cf005a7c24a188aa6fb42151d34233addf55d07fe142e"}
{"level":"info","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c3e201d828a398919aaa50bacf6b9f4c50bd08f2e2d5c6ad7cf19937643e457f"}
{"level":"info","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c6d9f28f619f2cbc796cf005a7c24a188aa6fb42151d34233addf55d07fe142e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c3e201d828a398919aaa50bacf6b9f4c50bd08f2e2d5c6ad7cf19937643e457f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T21:45:27Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T21:45:27Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c3e201d828a398919aaa50bacf6b9f4c50bd08f2e2d5c6ad7cf19937643e457f"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8e1bf902f300790503d4794e894e9cecf53d423625f748fef83ace3a460c4033"}
{"level":"info","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9354acbf0065c1ebdc9f059629e0503ebcfc62cc1ba4421302a0706c5970649a"}
{"level":"info","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8edf88dfcb8d164f1a5072e14f8425b790775decb520ba3299afb431d26ee8d4"}
{"level":"info","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c3e201d828a398919aaa50bacf6b9f4c50bd08f2e2d5c6ad7cf19937643e457f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8e1bf902f300790503d4794e894e9cecf53d423625f748fef83ace3a460c4033","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T21:45:27Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T21:45:27Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8e1bf902f300790503d4794e894e9cecf53d423625f748fef83ace3a460c4033"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5e6ba05e61dc00a61f0c78af217193bdbb8fb6fe5c7f8b6628c7992701f263a8"}
{"level":"info","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3ed3fe5726c461472bbd29142eba8dcd1f09051e52e6974b3c6f3de42bfcff5c"}
{"level":"info","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8e1bf902f300790503d4794e894e9cecf53d423625f748fef83ace3a460c4033","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9354acbf0065c1ebdc9f059629e0503ebcfc62cc1ba4421302a0706c5970649a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T21:45:27Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T21:45:27Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9354acbf0065c1ebdc9f059629e0503ebcfc62cc1ba4421302a0706c5970649a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c6d9f28f619f2cbc796cf005a7c24a188aa6fb42151d34233addf55d07fe142e"}
{"level":"info","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e9a94ccbb57a434a0850bdc1965d2b9cb29290f4be2c1265971c3bb70f812086"}
{"level":"info","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9354acbf0065c1ebdc9f059629e0503ebcfc62cc1ba4421302a0706c5970649a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8edf88dfcb8d164f1a5072e14f8425b790775decb520ba3299afb431d26ee8d4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T21:45:27Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T21:45:27Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8edf88dfcb8d164f1a5072e14f8425b790775decb520ba3299afb431d26ee8d4"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0383cdcd7b481b718641545bfbbbe827b5ec1e2fb271d9b468829fac739bab02"}
{"level":"info","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b2d77b6d99a7ca285cc673a1e5ce70089ecc14fb3b109dd57b3c219569bcce51"}
{"level":"info","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c3e201d828a398919aaa50bacf6b9f4c50bd08f2e2d5c6ad7cf19937643e457f"}
{"level":"info","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8edf88dfcb8d164f1a5072e14f8425b790775decb520ba3299afb431d26ee8d4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5e6ba05e61dc00a61f0c78af217193bdbb8fb6fe5c7f8b6628c7992701f263a8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T21:45:27Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T21:45:27Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["5e6ba05e61dc00a61f0c78af217193bdbb8fb6fe5c7f8b6628c7992701f263a8"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6ddd63f7ba2830a19b5c46cec643aafb070a6dd210268ddd3488b6fdc7dbde55"}
{"level":"info","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c34da97cb7d94945e6f6b08d53035bebe90aebe70a31827fba117a1f4b426788"}
{"level":"info","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5e6ba05e61dc00a61f0c78af217193bdbb8fb6fe5c7f8b6628c7992701f263a8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3ed3fe5726c461472bbd29142eba8dcd1f09051e52e6974b3c6f3de42bfcff5c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T21:45:27Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T21:45:27Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3ed3fe5726c461472bbd29142eba8dcd1f09051e52e6974b3c6f3de42bfcff5c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3d4193039f937e930003ad43ffb4b0a7f31d0bf22628089825c173cf54fb412c"}
{"level":"info","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8e1bf902f300790503d4794e894e9cecf53d423625f748fef83ace3a460c4033"}
{"level":"info","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ee0c6a27096f2e3b909d04b0370952da484d0ab0f61483103d65fc880890fdee"}
{"level":"info","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3ed3fe5726c461472bbd29142eba8dcd1f09051e52e6974b3c6f3de42bfcff5c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c6d9f28f619f2cbc796cf005a7c24a188aa6fb42151d34233addf55d07fe142e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T21:45:27Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T21:45:27Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c6d9f28f619f2cbc796cf005a7c24a188aa6fb42151d34233addf55d07fe142e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9354acbf0065c1ebdc9f059629e0503ebcfc62cc1ba4421302a0706c5970649a"}
{"level":"info","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8edf88dfcb8d164f1a5072e14f8425b790775decb520ba3299afb431d26ee8d4"}
{"level":"info","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c6d9f28f619f2cbc796cf005a7c24a188aa6fb42151d34233addf55d07fe142e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e9a94ccbb57a434a0850bdc1965d2b9cb29290f4be2c1265971c3bb70f812086","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T21:45:27Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T21:45:27Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e9a94ccbb57a434a0850bdc1965d2b9cb29290f4be2c1265971c3bb70f812086"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T21:45:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5e6ba05e61dc00a61f0c78af217193bdbb8fb6fe5c7f8b6628c7992701f263a8"}
{"level":"info","ts":"2026-07-22T21:45:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3ed3fe5726c461472bbd29142eba8dcd1f09051e52e6974b3c6f3de42bfcff5c"}
{"level":"info","ts":"2026-07-22T21:45:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e9a94ccbb57a434a0850bdc1965d2b9cb29290f4be2c1265971c3bb70f812086","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T21:45:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0383cdcd7b481b718641545bfbbbe827b5ec1e2fb271d9b468829fac739bab02","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T21:45:28Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T21:45:28Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["0383cdcd7b481b718641545bfbbbe827b5ec1e2fb271d9b468829fac739bab02"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T21:45:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c6d9f28f619f2cbc796cf005a7c24a188aa6fb42151d34233addf55d07fe142e"}
{"level":"info","ts":"2026-07-22T21:45:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0383cdcd7b481b718641545bfbbbe827b5ec1e2fb271d9b468829fac739bab02","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T21:45:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b2d77b6d99a7ca285cc673a1e5ce70089ecc14fb3b109dd57b3c219569bcce51","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T21:45:28Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T21:45:28Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b2d77b6d99a7ca285cc673a1e5ce70089ecc14fb3b109dd57b3c219569bcce51"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T21:45:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e9a94ccbb57a434a0850bdc1965d2b9cb29290f4be2c1265971c3bb70f812086"}
{"level":"info","ts":"2026-07-22T21:45:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0383cdcd7b481b718641545bfbbbe827b5ec1e2fb271d9b468829fac739bab02"}
{"level":"info","ts":"2026-07-22T21:45:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b2d77b6d99a7ca285cc673a1e5ce70089ecc14fb3b109dd57b3c219569bcce51","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T21:45:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c3e201d828a398919aaa50bacf6b9f4c50bd08f2e2d5c6ad7cf19937643e457f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T21:45:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6ddd63f7ba2830a19b5c46cec643aafb070a6dd210268ddd3488b6fdc7dbde55","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T21:45:28Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T21:45:28Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["6ddd63f7ba2830a19b5c46cec643aafb070a6dd210268ddd3488b6fdc7dbde55"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T21:45:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b2d77b6d99a7ca285cc673a1e5ce70089ecc14fb3b109dd57b3c219569bcce51"}
{"level":"info","ts":"2026-07-22T21:45:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6ddd63f7ba2830a19b5c46cec643aafb070a6dd210268ddd3488b6fdc7dbde55","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T21:45:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c34da97cb7d94945e6f6b08d53035bebe90aebe70a31827fba117a1f4b426788","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T21:45:28Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T21:45:28Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c34da97cb7d94945e6f6b08d53035bebe90aebe70a31827fba117a1f4b426788"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T21:45:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6ddd63f7ba2830a19b5c46cec643aafb070a6dd210268ddd3488b6fdc7dbde55"}
{"level":"info","ts":"2026-07-22T21:45:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c34da97cb7d94945e6f6b08d53035bebe90aebe70a31827fba117a1f4b426788","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T21:45:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3d4193039f937e930003ad43ffb4b0a7f31d0bf22628089825c173cf54fb412c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T21:45:28Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T21:45:28Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3d4193039f937e930003ad43ffb4b0a7f31d0bf22628089825c173cf54fb412c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T21:45:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c34da97cb7d94945e6f6b08d53035bebe90aebe70a31827fba117a1f4b426788"}
{"level":"info","ts":"2026-07-22T21:45:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3d4193039f937e930003ad43ffb4b0a7f31d0bf22628089825c173cf54fb412c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T21:45:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8e1bf902f300790503d4794e894e9cecf53d423625f748fef83ace3a460c4033","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T21:45:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ee0c6a27096f2e3b909d04b0370952da484d0ab0f61483103d65fc880890fdee","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T21:45:28Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T21:45:28Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ee0c6a27096f2e3b909d04b0370952da484d0ab0f61483103d65fc880890fdee"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T21:45:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3d4193039f937e930003ad43ffb4b0a7f31d0bf22628089825c173cf54fb412c"}
{"level":"info","ts":"2026-07-22T21:45:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ee0c6a27096f2e3b909d04b0370952da484d0ab0f61483103d65fc880890fdee","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T21:45:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9354acbf0065c1ebdc9f059629e0503ebcfc62cc1ba4421302a0706c5970649a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T21:45:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8edf88dfcb8d164f1a5072e14f8425b790775decb520ba3299afb431d26ee8d4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T21:45:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5e6ba05e61dc00a61f0c78af217193bdbb8fb6fe5c7f8b6628c7992701f263a8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T21:45:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3ed3fe5726c461472bbd29142eba8dcd1f09051e52e6974b3c6f3de42bfcff5c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T21:45:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c6d9f28f619f2cbc796cf005a7c24a188aa6fb42151d34233addf55d07fe142e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T21:45:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e9a94ccbb57a434a0850bdc1965d2b9cb29290f4be2c1265971c3bb70f812086","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T21:45:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0383cdcd7b481b718641545bfbbbe827b5ec1e2fb271d9b468829fac739bab02","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T21:45:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b2d77b6d99a7ca285cc673a1e5ce70089ecc14fb3b109dd57b3c219569bcce51","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T21:45:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6ddd63f7ba2830a19b5c46cec643aafb070a6dd210268ddd3488b6fdc7dbde55","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T21:45:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c34da97cb7d94945e6f6b08d53035bebe90aebe70a31827fba117a1f4b426788","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T21:45:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3d4193039f937e930003ad43ffb4b0a7f31d0bf22628089825c173cf54fb412c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T21:45:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ee0c6a27096f2e3b909d04b0370952da484d0ab0f61483103d65fc880890fdee","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T21:45:28Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T21:45:28Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T21:45:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ee0c6a27096f2e3b909d04b0370952da484d0ab0f61483103d65fc880890fdee"}
{"level":"info","ts":"2026-07-22T21:45:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ee0c6a27096f2e3b909d04b0370952da484d0ab0f61483103d65fc880890fdee","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T21:45:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ee0c6a27096f2e3b909d04b0370952da484d0ab0f61483103d65fc880890fdee","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T21:45:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ee0c6a27096f2e3b909d04b0370952da484d0ab0f61483103d65fc880890fdee","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-22T21:45:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ee0c6a27096f2e3b909d04b0370952da484d0ab0f61483103d65fc880890fdee"}
{"level":"debug","ts":"2026-07-22T21:45:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ee0c6a27096f2e3b909d04b0370952da484d0ab0f61483103d65fc880890fdee","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T21:45:28Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T21:45:28Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ee0c6a27096f2e3b909d04b0370952da484d0ab0f61483103d65fc880890fdee"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T21:45:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ee0c6a27096f2e3b909d04b0370952da484d0ab0f61483103d65fc880890fdee","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T21:45:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ee0c6a27096f2e3b909d04b0370952da484d0ab0f61483103d65fc880890fdee","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T21:45:28Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T21:45:28Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T21:45:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ee0c6a27096f2e3b909d04b0370952da484d0ab0f61483103d65fc880890fdee"}
{"level":"info","ts":"2026-07-22T21:45:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ee0c6a27096f2e3b909d04b0370952da484d0ab0f61483103d65fc880890fdee","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T21:45:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ee0c6a27096f2e3b909d04b0370952da484d0ab0f61483103d65fc880890fdee","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T21:45:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ee0c6a27096f2e3b909d04b0370952da484d0ab0f61483103d65fc880890fdee","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-22T21:45:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ee0c6a27096f2e3b909d04b0370952da484d0ab0f61483103d65fc880890fdee"}
{"level":"debug","ts":"2026-07-22T21:45:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ee0c6a27096f2e3b909d04b0370952da484d0ab0f61483103d65fc880890fdee","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T21:45:28Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T21:45:28Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ee0c6a27096f2e3b909d04b0370952da484d0ab0f61483103d65fc880890fdee"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T21:45:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ee0c6a27096f2e3b909d04b0370952da484d0ab0f61483103d65fc880890fdee","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T21:45:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ee0c6a27096f2e3b909d04b0370952da484d0ab0f61483103d65fc880890fdee","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T21:45:28Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T21:45:28Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T21:45:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ee0c6a27096f2e3b909d04b0370952da484d0ab0f61483103d65fc880890fdee"}
{"level":"info","ts":"2026-07-22T21:45:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ee0c6a27096f2e3b909d04b0370952da484d0ab0f61483103d65fc880890fdee","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T21:45:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ee0c6a27096f2e3b909d04b0370952da484d0ab0f61483103d65fc880890fdee","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T21:45:28Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T21:45:28Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ee0c6a27096f2e3b909d04b0370952da484d0ab0f61483103d65fc880890fdee"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T21:45:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ee0c6a27096f2e3b909d04b0370952da484d0ab0f61483103d65fc880890fdee"}
{"level":"info","ts":"2026-07-22T21:45:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ee0c6a27096f2e3b909d04b0370952da484d0ab0f61483103d65fc880890fdee","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T21:45:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ee0c6a27096f2e3b909d04b0370952da484d0ab0f61483103d65fc880890fdee","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T21:45:28Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T21:45:28Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ee0c6a27096f2e3b909d04b0370952da484d0ab0f61483103d65fc880890fdee"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T21:45:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ee0c6a27096f2e3b909d04b0370952da484d0ab0f61483103d65fc880890fdee"}
{"level":"error","ts":"2026-07-22T21:45:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"ee0c6a27096f2e3b909d04b0370952da484d0ab0f61483103d65fc880890fdee","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"ee0c6a27096f2e3b909d04b0370952da484d0ab0f61483103d65fc880890fdee\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-22T21:45:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ee0c6a27096f2e3b909d04b0370952da484d0ab0f61483103d65fc880890fdee","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T21:45:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ee0c6a27096f2e3b909d04b0370952da484d0ab0f61483103d65fc880890fdee","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-22T21:45:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"eba1ea21-2f44-4ef3-802d-13401e42750d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.13:47928","PortSpecifier":{"PortValue":47928}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"eba1ea21-2f44-4ef3-802d-13401e42750d","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-644efc.apps.73972a97-1adb-4b97-ac41-1111e9d9a3d1.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T21:45:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"eba1ea21-2f44-4ef3-802d-13401e42750d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.13:47928","PortSpecifier":{"PortValue":47928}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784756730,"nanos":844689955},"http":{"id":"eba1ea21-2f44-4ef3-802d-13401e42750d","method":"POST","headers":{":authority":"e2e-shared-a-644efc.apps.73972a97-1adb-4b97-ac41-1111e9d9a3d1.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T21:45:30Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"eba1ea21-2f44-4ef3-802d-13401e42750d","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-22T21:45:30Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"eba1ea21-2f44-4ef3-802d-13401e42750d","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"4a2ac7de-4c49-47a1-bc49-f73ac1757acf","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=21c673dc-657d-4dfc-b73c-396658381b0a"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1111e9d9a3d1"]}}
{"level":"debug","ts":"2026-07-22T21:45:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"eba1ea21-2f44-4ef3-802d-13401e42750d","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1111e9d9a3d1"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=21c673dc-657d-4dfc-b73c-396658381b0a"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"4a2ac7de-4c49-47a1-bc49-f73ac1757acf","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"ee0c6a27096f2e3b909d04b0370952da484d0ab0f61483103d65fc880890fdee"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.49:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-644efc.apps.73972a97-1adb-4b97-ac41-1111e9d9a3d1.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T21:45:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"eba1ea21-2f44-4ef3-802d-13401e42750d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T21:45:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"eba1ea21-2f44-4ef3-802d-13401e42750d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T21:45:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"eba1ea21-2f44-4ef3-802d-13401e42750d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-644efc/rate-test-model-644efc\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-644efc/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T21:45:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"eba1ea21-2f44-4ef3-802d-13401e42750d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-22T21:45:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"eba1ea21-2f44-4ef3-802d-13401e42750d","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T21:45:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"eba1ea21-2f44-4ef3-802d-13401e42750d","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-22T21:45:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"eba1ea21-2f44-4ef3-802d-13401e42750d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T21:45:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"eba1ea21-2f44-4ef3-802d-13401e42750d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T21:45:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9aff9e18-144e-4bb7-b401-4f736f511120","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.13:56504","PortSpecifier":{"PortValue":56504}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.50:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9aff9e18-144e-4bb7-b401-4f736f511120","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-bfd0ef.apps.73972a97-1adb-4b97-ac41-1111e9d9a3d1.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T21:45:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9aff9e18-144e-4bb7-b401-4f736f511120","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.13:56504","PortSpecifier":{"PortValue":56504}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.50:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784756730,"nanos":885395817},"http":{"id":"9aff9e18-144e-4bb7-b401-4f736f511120","method":"POST","headers":{":authority":"e2e-shared-b-bfd0ef.apps.73972a97-1adb-4b97-ac41-1111e9d9a3d1.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T21:45:30Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"9aff9e18-144e-4bb7-b401-4f736f511120","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-22T21:45:30Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9aff9e18-144e-4bb7-b401-4f736f511120","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"4a2ac7de-4c49-47a1-bc49-f73ac1757acf","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=21c673dc-657d-4dfc-b73c-396658381b0a"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1111e9d9a3d1"]}}
{"level":"debug","ts":"2026-07-22T21:45:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9aff9e18-144e-4bb7-b401-4f736f511120","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1111e9d9a3d1"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=21c673dc-657d-4dfc-b73c-396658381b0a"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"4a2ac7de-4c49-47a1-bc49-f73ac1757acf","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"ce4dd60950e836d1bf731b644c1cdfe6ce8c9b47881f962d74017bf59057d6de"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.50:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-bfd0ef.apps.73972a97-1adb-4b97-ac41-1111e9d9a3d1.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T21:45:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9aff9e18-144e-4bb7-b401-4f736f511120","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T21:45:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9aff9e18-144e-4bb7-b401-4f736f511120","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T21:45:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9aff9e18-144e-4bb7-b401-4f736f511120","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-bfd0ef/rate-test-model-bfd0ef\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-bfd0ef/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T21:45:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"9aff9e18-144e-4bb7-b401-4f736f511120","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-22T21:45:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9aff9e18-144e-4bb7-b401-4f736f511120","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T21:45:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9aff9e18-144e-4bb7-b401-4f736f511120","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-22T21:45:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9aff9e18-144e-4bb7-b401-4f736f511120","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T21:45:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9aff9e18-144e-4bb7-b401-4f736f511120","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T21:45:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"66cb3254-3de9-467b-b217-2828eefb91ce","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.13:47934","PortSpecifier":{"PortValue":47934}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"66cb3254-3de9-467b-b217-2828eefb91ce","method":"POST","path":"/ai-tenant-e2e-shared-a-644efc/rate-test-model-644efc/v1/completions","host":"e2e-shared-a-644efc.apps.73972a97-1adb-4b97-ac41-1111e9d9a3d1.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T21:45:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"66cb3254-3de9-467b-b217-2828eefb91ce","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.13:47934","PortSpecifier":{"PortValue":47934}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784756730,"nanos":927960393},"http":{"id":"66cb3254-3de9-467b-b217-2828eefb91ce","method":"POST","headers":{":authority":"e2e-shared-a-644efc.apps.73972a97-1adb-4b97-ac41-1111e9d9a3d1.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-644efc/rate-test-model-644efc/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T21:45:30Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"66cb3254-3de9-467b-b217-2828eefb91ce","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-UdhVduUoRYcP00G1_Pzk8RVZqqXTuHmdniEIGK7EB7tuH3X7No50KEElt0HG"}
{"level":"debug","ts":"2026-07-22T21:45:30Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"66cb3254-3de9-467b-b217-2828eefb91ce","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-644efc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-UdhVduUoRYcP00G1_Pzk8RVZqqXTuHmdniEIGK7EB7tuH3X7No50KEElt0HG\"}"}
{"level":"debug","ts":"2026-07-22T21:45:30Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"66cb3254-3de9-467b-b217-2828eefb91ce","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-644efc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"936913ad-8df9-4076-8f50-17c7b464ea11","keyName":"e2e-rate-a-5cce46","subscription":"e2e-rate-iso-a-5cce46","tenant":"e2e-shared-a-644efc","userId":"936913ad-8df9-4076-8f50-17c7b464ea11","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-22T21:45:30Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"66cb3254-3de9-467b-b217-2828eefb91ce","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-644efc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-644efc/rate-test-model-644efc\",\"requestedSubscription\":\"e2e-rate-iso-a-5cce46\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-22T21:45:30Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"66cb3254-3de9-467b-b217-2828eefb91ce","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-644efc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-644efc","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-5cce46","namespace":"ai-tenant-e2e-shared-a-644efc","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-644efc/rate-test-model-644efc"}}
{"level":"debug","ts":"2026-07-22T21:45:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"66cb3254-3de9-467b-b217-2828eefb91ce","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T21:45:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"66cb3254-3de9-467b-b217-2828eefb91ce","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T21:45:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"66cb3254-3de9-467b-b217-2828eefb91ce","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T21:45:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"66cb3254-3de9-467b-b217-2828eefb91ce","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T21:45:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"66cb3254-3de9-467b-b217-2828eefb91ce","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-644efc/rate-test-model-644efc\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-644efc/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T21:45:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"66cb3254-3de9-467b-b217-2828eefb91ce","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T21:45:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"66cb3254-3de9-467b-b217-2828eefb91ce","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-5cce46"}
{"level":"debug","ts":"2026-07-22T21:45:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"66cb3254-3de9-467b-b217-2828eefb91ce","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T21:45:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"66cb3254-3de9-467b-b217-2828eefb91ce","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"936913ad-8df9-4076-8f50-17c7b464ea11","keyName":"e2e-rate-a-5cce46","selected_subscription":"e2e-rate-iso-a-5cce46","selected_subscription_key":"ai-tenant-e2e-shared-a-644efc/e2e-rate-iso-a-5cce46@ai-tenant-e2e-shared-a-644efc/rate-test-model-644efc","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-644efc","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-5cce46","namespace":"ai-tenant-e2e-shared-a-644efc","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-644efc/rate-test-model-644efc"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-22T21:45:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"66cb3254-3de9-467b-b217-2828eefb91ce","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T21:45:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"66cb3254-3de9-467b-b217-2828eefb91ce","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T21:45:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c7f09771-4505-4c1d-bf0f-a3044c50b15c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.13:47950","PortSpecifier":{"PortValue":47950}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c7f09771-4505-4c1d-bf0f-a3044c50b15c","method":"POST","path":"/ai-tenant-e2e-shared-a-644efc/rate-test-model-644efc/v1/completions","host":"e2e-shared-a-644efc.apps.73972a97-1adb-4b97-ac41-1111e9d9a3d1.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T21:45:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c7f09771-4505-4c1d-bf0f-a3044c50b15c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.13:47950","PortSpecifier":{"PortValue":47950}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784756731,"nanos":992330724},"http":{"id":"c7f09771-4505-4c1d-bf0f-a3044c50b15c","method":"POST","headers":{":authority":"e2e-shared-a-644efc.apps.73972a97-1adb-4b97-ac41-1111e9d9a3d1.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-644efc/rate-test-model-644efc/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T21:45:31Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"c7f09771-4505-4c1d-bf0f-a3044c50b15c","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-UdhVduUoRYcP00G1_Pzk8RVZqqXTuHmdniEIGK7EB7tuH3X7No50KEElt0HG"}
{"level":"debug","ts":"2026-07-22T21:45:31Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c7f09771-4505-4c1d-bf0f-a3044c50b15c","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-644efc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-UdhVduUoRYcP00G1_Pzk8RVZqqXTuHmdniEIGK7EB7tuH3X7No50KEElt0HG\"}"}
{"level":"debug","ts":"2026-07-22T21:45:31Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c7f09771-4505-4c1d-bf0f-a3044c50b15c","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-644efc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"936913ad-8df9-4076-8f50-17c7b464ea11","keyName":"e2e-rate-a-5cce46","subscription":"e2e-rate-iso-a-5cce46","tenant":"e2e-shared-a-644efc","userId":"936913ad-8df9-4076-8f50-17c7b464ea11","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-22T21:45:31Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c7f09771-4505-4c1d-bf0f-a3044c50b15c","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-644efc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-644efc/rate-test-model-644efc\",\"requestedSubscription\":\"e2e-rate-iso-a-5cce46\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-22T21:45:31Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c7f09771-4505-4c1d-bf0f-a3044c50b15c","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-644efc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-644efc","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-5cce46","namespace":"ai-tenant-e2e-shared-a-644efc","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-644efc/rate-test-model-644efc"}}
{"level":"debug","ts":"2026-07-22T21:45:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"c7f09771-4505-4c1d-bf0f-a3044c50b15c","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T21:45:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c7f09771-4505-4c1d-bf0f-a3044c50b15c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T21:45:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c7f09771-4505-4c1d-bf0f-a3044c50b15c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T21:45:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c7f09771-4505-4c1d-bf0f-a3044c50b15c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-644efc/rate-test-model-644efc\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-644efc/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T21:45:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c7f09771-4505-4c1d-bf0f-a3044c50b15c","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T21:45:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c7f09771-4505-4c1d-bf0f-a3044c50b15c","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T21:45:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c7f09771-4505-4c1d-bf0f-a3044c50b15c","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T21:45:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c7f09771-4505-4c1d-bf0f-a3044c50b15c","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-5cce46"}
{"level":"debug","ts":"2026-07-22T21:45:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c7f09771-4505-4c1d-bf0f-a3044c50b15c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"936913ad-8df9-4076-8f50-17c7b464ea11","keyName":"e2e-rate-a-5cce46","selected_subscription":"e2e-rate-iso-a-5cce46","selected_subscription_key":"ai-tenant-e2e-shared-a-644efc/e2e-rate-iso-a-5cce46@ai-tenant-e2e-shared-a-644efc/rate-test-model-644efc","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-644efc","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-5cce46","namespace":"ai-tenant-e2e-shared-a-644efc","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-644efc/rate-test-model-644efc"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-22T21:45:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c7f09771-4505-4c1d-bf0f-a3044c50b15c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T21:45:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c7f09771-4505-4c1d-bf0f-a3044c50b15c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T21:45:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5865060f-a213-4d04-8ba7-caf697c4bb8a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.13:44244","PortSpecifier":{"PortValue":44244}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5865060f-a213-4d04-8ba7-caf697c4bb8a","method":"POST","path":"/ai-tenant-e2e-shared-a-644efc/rate-test-model-644efc/v1/completions","host":"e2e-shared-a-644efc.apps.73972a97-1adb-4b97-ac41-1111e9d9a3d1.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T21:45:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5865060f-a213-4d04-8ba7-caf697c4bb8a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.13:44244","PortSpecifier":{"PortValue":44244}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784756733,"nanos":27332768},"http":{"id":"5865060f-a213-4d04-8ba7-caf697c4bb8a","method":"POST","headers":{":authority":"e2e-shared-a-644efc.apps.73972a97-1adb-4b97-ac41-1111e9d9a3d1.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-644efc/rate-test-model-644efc/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T21:45:33Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5865060f-a213-4d04-8ba7-caf697c4bb8a","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-UdhVduUoRYcP00G1_Pzk8RVZqqXTuHmdniEIGK7EB7tuH3X7No50KEElt0HG"}
{"level":"debug","ts":"2026-07-22T21:45:33Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5865060f-a213-4d04-8ba7-caf697c4bb8a","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-644efc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-UdhVduUoRYcP00G1_Pzk8RVZqqXTuHmdniEIGK7EB7tuH3X7No50KEElt0HG\"}"}
{"level":"debug","ts":"2026-07-22T21:45:33Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5865060f-a213-4d04-8ba7-caf697c4bb8a","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-644efc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"936913ad-8df9-4076-8f50-17c7b464ea11","keyName":"e2e-rate-a-5cce46","subscription":"e2e-rate-iso-a-5cce46","tenant":"e2e-shared-a-644efc","userId":"936913ad-8df9-4076-8f50-17c7b464ea11","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-22T21:45:33Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5865060f-a213-4d04-8ba7-caf697c4bb8a","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-644efc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-644efc/rate-test-model-644efc\",\"requestedSubscription\":\"e2e-rate-iso-a-5cce46\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-22T21:45:33Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5865060f-a213-4d04-8ba7-caf697c4bb8a","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-644efc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-644efc","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-5cce46","namespace":"ai-tenant-e2e-shared-a-644efc","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-644efc/rate-test-model-644efc"}}
{"level":"debug","ts":"2026-07-22T21:45:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5865060f-a213-4d04-8ba7-caf697c4bb8a","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T21:45:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5865060f-a213-4d04-8ba7-caf697c4bb8a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T21:45:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5865060f-a213-4d04-8ba7-caf697c4bb8a","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T21:45:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5865060f-a213-4d04-8ba7-caf697c4bb8a","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-644efc/rate-test-model-644efc\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-644efc/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T21:45:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5865060f-a213-4d04-8ba7-caf697c4bb8a","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T21:45:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5865060f-a213-4d04-8ba7-caf697c4bb8a","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-5cce46"}
{"level":"debug","ts":"2026-07-22T21:45:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5865060f-a213-4d04-8ba7-caf697c4bb8a","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T21:45:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5865060f-a213-4d04-8ba7-caf697c4bb8a","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T21:45:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5865060f-a213-4d04-8ba7-caf697c4bb8a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"936913ad-8df9-4076-8f50-17c7b464ea11","keyName":"e2e-rate-a-5cce46","selected_subscription":"e2e-rate-iso-a-5cce46","selected_subscription_key":"ai-tenant-e2e-shared-a-644efc/e2e-rate-iso-a-5cce46@ai-tenant-e2e-shared-a-644efc/rate-test-model-644efc","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-644efc","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-5cce46","namespace":"ai-tenant-e2e-shared-a-644efc","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-644efc/rate-test-model-644efc"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-22T21:45:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5865060f-a213-4d04-8ba7-caf697c4bb8a","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T21:45:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5865060f-a213-4d04-8ba7-caf697c4bb8a","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T21:45:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a82fd5d6-888c-4b12-a6ce-846ce357da04","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.13:44260","PortSpecifier":{"PortValue":44260}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a82fd5d6-888c-4b12-a6ce-846ce357da04","method":"POST","path":"/ai-tenant-e2e-shared-a-644efc/rate-test-model-644efc/v1/completions","host":"e2e-shared-a-644efc.apps.73972a97-1adb-4b97-ac41-1111e9d9a3d1.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T21:45:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a82fd5d6-888c-4b12-a6ce-846ce357da04","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.13:44260","PortSpecifier":{"PortValue":44260}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784756734,"nanos":60653398},"http":{"id":"a82fd5d6-888c-4b12-a6ce-846ce357da04","method":"POST","headers":{":authority":"e2e-shared-a-644efc.apps.73972a97-1adb-4b97-ac41-1111e9d9a3d1.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-644efc/rate-test-model-644efc/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T21:45:34Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a82fd5d6-888c-4b12-a6ce-846ce357da04","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-UdhVduUoRYcP00G1_Pzk8RVZqqXTuHmdniEIGK7EB7tuH3X7No50KEElt0HG"}
{"level":"debug","ts":"2026-07-22T21:45:34Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a82fd5d6-888c-4b12-a6ce-846ce357da04","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-644efc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-UdhVduUoRYcP00G1_Pzk8RVZqqXTuHmdniEIGK7EB7tuH3X7No50KEElt0HG\"}"}
{"level":"debug","ts":"2026-07-22T21:45:34Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a82fd5d6-888c-4b12-a6ce-846ce357da04","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-644efc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"936913ad-8df9-4076-8f50-17c7b464ea11","keyName":"e2e-rate-a-5cce46","subscription":"e2e-rate-iso-a-5cce46","tenant":"e2e-shared-a-644efc","userId":"936913ad-8df9-4076-8f50-17c7b464ea11","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-22T21:45:34Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a82fd5d6-888c-4b12-a6ce-846ce357da04","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-644efc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-644efc/rate-test-model-644efc\",\"requestedSubscription\":\"e2e-rate-iso-a-5cce46\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-22T21:45:34Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a82fd5d6-888c-4b12-a6ce-846ce357da04","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-644efc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-644efc","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-5cce46","namespace":"ai-tenant-e2e-shared-a-644efc","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-644efc/rate-test-model-644efc"}}
{"level":"debug","ts":"2026-07-22T21:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a82fd5d6-888c-4b12-a6ce-846ce357da04","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T21:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a82fd5d6-888c-4b12-a6ce-846ce357da04","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T21:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a82fd5d6-888c-4b12-a6ce-846ce357da04","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T21:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a82fd5d6-888c-4b12-a6ce-846ce357da04","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T21:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a82fd5d6-888c-4b12-a6ce-846ce357da04","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-644efc/rate-test-model-644efc\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-644efc/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T21:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a82fd5d6-888c-4b12-a6ce-846ce357da04","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T21:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a82fd5d6-888c-4b12-a6ce-846ce357da04","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-5cce46"}
{"level":"debug","ts":"2026-07-22T21:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a82fd5d6-888c-4b12-a6ce-846ce357da04","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T21:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a82fd5d6-888c-4b12-a6ce-846ce357da04","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"936913ad-8df9-4076-8f50-17c7b464ea11","keyName":"e2e-rate-a-5cce46","selected_subscription":"e2e-rate-iso-a-5cce46","selected_subscription_key":"ai-tenant-e2e-shared-a-644efc/e2e-rate-iso-a-5cce46@ai-tenant-e2e-shared-a-644efc/rate-test-model-644efc","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-644efc","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-5cce46","namespace":"ai-tenant-e2e-shared-a-644efc","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-644efc/rate-test-model-644efc"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-22T21:45:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a82fd5d6-888c-4b12-a6ce-846ce357da04","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T21:45:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a82fd5d6-888c-4b12-a6ce-846ce357da04","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T21:45:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1c4e7a16-b6ac-4a58-8200-e2c06391ae25","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.13:44262","PortSpecifier":{"PortValue":44262}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1c4e7a16-b6ac-4a58-8200-e2c06391ae25","method":"POST","path":"/ai-tenant-e2e-shared-a-644efc/rate-test-model-644efc/v1/completions","host":"e2e-shared-a-644efc.apps.73972a97-1adb-4b97-ac41-1111e9d9a3d1.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T21:45:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1c4e7a16-b6ac-4a58-8200-e2c06391ae25","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.13:44262","PortSpecifier":{"PortValue":44262}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784756735,"nanos":99535608},"http":{"id":"1c4e7a16-b6ac-4a58-8200-e2c06391ae25","method":"POST","headers":{":authority":"e2e-shared-a-644efc.apps.73972a97-1adb-4b97-ac41-1111e9d9a3d1.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-644efc/rate-test-model-644efc/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T21:45:35Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1c4e7a16-b6ac-4a58-8200-e2c06391ae25","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-UdhVduUoRYcP00G1_Pzk8RVZqqXTuHmdniEIGK7EB7tuH3X7No50KEElt0HG"}
{"level":"debug","ts":"2026-07-22T21:45:35Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1c4e7a16-b6ac-4a58-8200-e2c06391ae25","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-644efc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-UdhVduUoRYcP00G1_Pzk8RVZqqXTuHmdniEIGK7EB7tuH3X7No50KEElt0HG\"}"}
{"level":"debug","ts":"2026-07-22T21:45:35Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1c4e7a16-b6ac-4a58-8200-e2c06391ae25","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-644efc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"936913ad-8df9-4076-8f50-17c7b464ea11","keyName":"e2e-rate-a-5cce46","subscription":"e2e-rate-iso-a-5cce46","tenant":"e2e-shared-a-644efc","userId":"936913ad-8df9-4076-8f50-17c7b464ea11","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-22T21:45:35Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1c4e7a16-b6ac-4a58-8200-e2c06391ae25","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-644efc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-644efc/rate-test-model-644efc\",\"requestedSubscription\":\"e2e-rate-iso-a-5cce46\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-22T21:45:35Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1c4e7a16-b6ac-4a58-8200-e2c06391ae25","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-644efc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-644efc","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-5cce46","namespace":"ai-tenant-e2e-shared-a-644efc","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-644efc/rate-test-model-644efc"}}
{"level":"debug","ts":"2026-07-22T21:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1c4e7a16-b6ac-4a58-8200-e2c06391ae25","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T21:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1c4e7a16-b6ac-4a58-8200-e2c06391ae25","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T21:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1c4e7a16-b6ac-4a58-8200-e2c06391ae25","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T21:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1c4e7a16-b6ac-4a58-8200-e2c06391ae25","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T21:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1c4e7a16-b6ac-4a58-8200-e2c06391ae25","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-644efc/rate-test-model-644efc\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-644efc/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T21:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1c4e7a16-b6ac-4a58-8200-e2c06391ae25","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T21:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1c4e7a16-b6ac-4a58-8200-e2c06391ae25","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-5cce46"}
{"level":"debug","ts":"2026-07-22T21:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1c4e7a16-b6ac-4a58-8200-e2c06391ae25","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T21:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1c4e7a16-b6ac-4a58-8200-e2c06391ae25","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"936913ad-8df9-4076-8f50-17c7b464ea11","keyName":"e2e-rate-a-5cce46","selected_subscription":"e2e-rate-iso-a-5cce46","selected_subscription_key":"ai-tenant-e2e-shared-a-644efc/e2e-rate-iso-a-5cce46@ai-tenant-e2e-shared-a-644efc/rate-test-model-644efc","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-644efc","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-5cce46","namespace":"ai-tenant-e2e-shared-a-644efc","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-644efc/rate-test-model-644efc"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-22T21:45:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1c4e7a16-b6ac-4a58-8200-e2c06391ae25","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T21:45:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1c4e7a16-b6ac-4a58-8200-e2c06391ae25","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T21:45:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9168b8a9-5449-49ae-adee-1d9d75aa92f8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.13:44276","PortSpecifier":{"PortValue":44276}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9168b8a9-5449-49ae-adee-1d9d75aa92f8","method":"POST","path":"/ai-tenant-e2e-shared-a-644efc/rate-test-model-644efc/v1/completions","host":"e2e-shared-a-644efc.apps.73972a97-1adb-4b97-ac41-1111e9d9a3d1.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T21:45:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9168b8a9-5449-49ae-adee-1d9d75aa92f8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.13:44276","PortSpecifier":{"PortValue":44276}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784756736,"nanos":134430705},"http":{"id":"9168b8a9-5449-49ae-adee-1d9d75aa92f8","method":"POST","headers":{":authority":"e2e-shared-a-644efc.apps.73972a97-1adb-4b97-ac41-1111e9d9a3d1.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-644efc/rate-test-model-644efc/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T21:45:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9168b8a9-5449-49ae-adee-1d9d75aa92f8","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-UdhVduUoRYcP00G1_Pzk8RVZqqXTuHmdniEIGK7EB7tuH3X7No50KEElt0HG"}
{"level":"debug","ts":"2026-07-22T21:45:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9168b8a9-5449-49ae-adee-1d9d75aa92f8","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-644efc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-UdhVduUoRYcP00G1_Pzk8RVZqqXTuHmdniEIGK7EB7tuH3X7No50KEElt0HG\"}"}
{"level":"debug","ts":"2026-07-22T21:45:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9168b8a9-5449-49ae-adee-1d9d75aa92f8","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-644efc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"936913ad-8df9-4076-8f50-17c7b464ea11","keyName":"e2e-rate-a-5cce46","subscription":"e2e-rate-iso-a-5cce46","tenant":"e2e-shared-a-644efc","userId":"936913ad-8df9-4076-8f50-17c7b464ea11","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-22T21:45:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9168b8a9-5449-49ae-adee-1d9d75aa92f8","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-644efc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-644efc/rate-test-model-644efc\",\"requestedSubscription\":\"e2e-rate-iso-a-5cce46\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-22T21:45:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9168b8a9-5449-49ae-adee-1d9d75aa92f8","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-644efc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-644efc","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-5cce46","namespace":"ai-tenant-e2e-shared-a-644efc","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-644efc/rate-test-model-644efc"}}
{"level":"debug","ts":"2026-07-22T21:45:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9168b8a9-5449-49ae-adee-1d9d75aa92f8","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T21:45:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9168b8a9-5449-49ae-adee-1d9d75aa92f8","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T21:45:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9168b8a9-5449-49ae-adee-1d9d75aa92f8","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T21:45:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9168b8a9-5449-49ae-adee-1d9d75aa92f8","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-644efc/rate-test-model-644efc\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-644efc/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T21:45:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9168b8a9-5449-49ae-adee-1d9d75aa92f8","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T21:45:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9168b8a9-5449-49ae-adee-1d9d75aa92f8","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T21:45:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9168b8a9-5449-49ae-adee-1d9d75aa92f8","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-5cce46"}
{"level":"debug","ts":"2026-07-22T21:45:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9168b8a9-5449-49ae-adee-1d9d75aa92f8","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T21:45:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9168b8a9-5449-49ae-adee-1d9d75aa92f8","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"936913ad-8df9-4076-8f50-17c7b464ea11","keyName":"e2e-rate-a-5cce46","selected_subscription":"e2e-rate-iso-a-5cce46","selected_subscription_key":"ai-tenant-e2e-shared-a-644efc/e2e-rate-iso-a-5cce46@ai-tenant-e2e-shared-a-644efc/rate-test-model-644efc","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-644efc","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-5cce46","namespace":"ai-tenant-e2e-shared-a-644efc","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-644efc/rate-test-model-644efc"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-22T21:45:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9168b8a9-5449-49ae-adee-1d9d75aa92f8","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T21:45:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9168b8a9-5449-49ae-adee-1d9d75aa92f8","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T21:45:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"71dd686a-a14f-4a21-8ee9-50b958a8dd9e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.13:44284","PortSpecifier":{"PortValue":44284}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"71dd686a-a14f-4a21-8ee9-50b958a8dd9e","method":"POST","path":"/ai-tenant-e2e-shared-a-644efc/rate-test-model-644efc/v1/completions","host":"e2e-shared-a-644efc.apps.73972a97-1adb-4b97-ac41-1111e9d9a3d1.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T21:45:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"71dd686a-a14f-4a21-8ee9-50b958a8dd9e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.13:44284","PortSpecifier":{"PortValue":44284}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784756737,"nanos":174297238},"http":{"id":"71dd686a-a14f-4a21-8ee9-50b958a8dd9e","method":"POST","headers":{":authority":"e2e-shared-a-644efc.apps.73972a97-1adb-4b97-ac41-1111e9d9a3d1.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-644efc/rate-test-model-644efc/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T21:45:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"71dd686a-a14f-4a21-8ee9-50b958a8dd9e","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-UdhVduUoRYcP00G1_Pzk8RVZqqXTuHmdniEIGK7EB7tuH3X7No50KEElt0HG"}
{"level":"debug","ts":"2026-07-22T21:45:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"71dd686a-a14f-4a21-8ee9-50b958a8dd9e","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-644efc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-UdhVduUoRYcP00G1_Pzk8RVZqqXTuHmdniEIGK7EB7tuH3X7No50KEElt0HG\"}"}
{"level":"debug","ts":"2026-07-22T21:45:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"71dd686a-a14f-4a21-8ee9-50b958a8dd9e","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-644efc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"936913ad-8df9-4076-8f50-17c7b464ea11","keyName":"e2e-rate-a-5cce46","subscription":"e2e-rate-iso-a-5cce46","tenant":"e2e-shared-a-644efc","userId":"936913ad-8df9-4076-8f50-17c7b464ea11","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-22T21:45:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"71dd686a-a14f-4a21-8ee9-50b958a8dd9e","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-644efc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-644efc/rate-test-model-644efc\",\"requestedSubscription\":\"e2e-rate-iso-a-5cce46\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-22T21:45:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"71dd686a-a14f-4a21-8ee9-50b958a8dd9e","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-644efc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-644efc","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-5cce46","namespace":"ai-tenant-e2e-shared-a-644efc","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-644efc/rate-test-model-644efc"}}
{"level":"debug","ts":"2026-07-22T21:45:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"71dd686a-a14f-4a21-8ee9-50b958a8dd9e","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T21:45:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"71dd686a-a14f-4a21-8ee9-50b958a8dd9e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T21:45:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"71dd686a-a14f-4a21-8ee9-50b958a8dd9e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T21:45:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"71dd686a-a14f-4a21-8ee9-50b958a8dd9e","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T21:45:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"71dd686a-a14f-4a21-8ee9-50b958a8dd9e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-644efc/rate-test-model-644efc\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-644efc/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T21:45:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"71dd686a-a14f-4a21-8ee9-50b958a8dd9e","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T21:45:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"71dd686a-a14f-4a21-8ee9-50b958a8dd9e","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-5cce46"}
{"level":"debug","ts":"2026-07-22T21:45:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"71dd686a-a14f-4a21-8ee9-50b958a8dd9e","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T21:45:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"71dd686a-a14f-4a21-8ee9-50b958a8dd9e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"936913ad-8df9-4076-8f50-17c7b464ea11","keyName":"e2e-rate-a-5cce46","selected_subscription":"e2e-rate-iso-a-5cce46","selected_subscription_key":"ai-tenant-e2e-shared-a-644efc/e2e-rate-iso-a-5cce46@ai-tenant-e2e-shared-a-644efc/rate-test-model-644efc","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-644efc","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-5cce46","namespace":"ai-tenant-e2e-shared-a-644efc","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-644efc/rate-test-model-644efc"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-22T21:45:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"71dd686a-a14f-4a21-8ee9-50b958a8dd9e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T21:45:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"71dd686a-a14f-4a21-8ee9-50b958a8dd9e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T21:45:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a878e373-1aa7-489d-90bf-7bb7bf1f288e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.13:44300","PortSpecifier":{"PortValue":44300}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a878e373-1aa7-489d-90bf-7bb7bf1f288e","method":"POST","path":"/ai-tenant-e2e-shared-a-644efc/rate-test-model-644efc/v1/completions","host":"e2e-shared-a-644efc.apps.73972a97-1adb-4b97-ac41-1111e9d9a3d1.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T21:45:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a878e373-1aa7-489d-90bf-7bb7bf1f288e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.13:44300","PortSpecifier":{"PortValue":44300}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784756738,"nanos":209563936},"http":{"id":"a878e373-1aa7-489d-90bf-7bb7bf1f288e","method":"POST","headers":{":authority":"e2e-shared-a-644efc.apps.73972a97-1adb-4b97-ac41-1111e9d9a3d1.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-644efc/rate-test-model-644efc/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T21:45:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a878e373-1aa7-489d-90bf-7bb7bf1f288e","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-UdhVduUoRYcP00G1_Pzk8RVZqqXTuHmdniEIGK7EB7tuH3X7No50KEElt0HG"}
{"level":"debug","ts":"2026-07-22T21:45:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a878e373-1aa7-489d-90bf-7bb7bf1f288e","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-644efc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-UdhVduUoRYcP00G1_Pzk8RVZqqXTuHmdniEIGK7EB7tuH3X7No50KEElt0HG\"}"}
{"level":"debug","ts":"2026-07-22T21:45:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a878e373-1aa7-489d-90bf-7bb7bf1f288e","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-644efc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"936913ad-8df9-4076-8f50-17c7b464ea11","keyName":"e2e-rate-a-5cce46","subscription":"e2e-rate-iso-a-5cce46","tenant":"e2e-shared-a-644efc","userId":"936913ad-8df9-4076-8f50-17c7b464ea11","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-22T21:45:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a878e373-1aa7-489d-90bf-7bb7bf1f288e","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-644efc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-644efc/rate-test-model-644efc\",\"requestedSubscription\":\"e2e-rate-iso-a-5cce46\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-22T21:45:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a878e373-1aa7-489d-90bf-7bb7bf1f288e","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-644efc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-644efc","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-5cce46","namespace":"ai-tenant-e2e-shared-a-644efc","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-644efc/rate-test-model-644efc"}}
{"level":"debug","ts":"2026-07-22T21:45:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a878e373-1aa7-489d-90bf-7bb7bf1f288e","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T21:45:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a878e373-1aa7-489d-90bf-7bb7bf1f288e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T21:45:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a878e373-1aa7-489d-90bf-7bb7bf1f288e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T21:45:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a878e373-1aa7-489d-90bf-7bb7bf1f288e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-644efc/rate-test-model-644efc\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-644efc/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T21:45:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a878e373-1aa7-489d-90bf-7bb7bf1f288e","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T21:45:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a878e373-1aa7-489d-90bf-7bb7bf1f288e","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T21:45:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a878e373-1aa7-489d-90bf-7bb7bf1f288e","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T21:45:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a878e373-1aa7-489d-90bf-7bb7bf1f288e","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-5cce46"}
{"level":"debug","ts":"2026-07-22T21:45:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a878e373-1aa7-489d-90bf-7bb7bf1f288e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"936913ad-8df9-4076-8f50-17c7b464ea11","keyName":"e2e-rate-a-5cce46","selected_subscription":"e2e-rate-iso-a-5cce46","selected_subscription_key":"ai-tenant-e2e-shared-a-644efc/e2e-rate-iso-a-5cce46@ai-tenant-e2e-shared-a-644efc/rate-test-model-644efc","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-644efc","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-5cce46","namespace":"ai-tenant-e2e-shared-a-644efc","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-644efc/rate-test-model-644efc"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-22T21:45:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a878e373-1aa7-489d-90bf-7bb7bf1f288e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T21:45:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a878e373-1aa7-489d-90bf-7bb7bf1f288e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T21:45:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9870a0bc-9b09-4e8e-a320-3829b5d0d5e8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.13:44316","PortSpecifier":{"PortValue":44316}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9870a0bc-9b09-4e8e-a320-3829b5d0d5e8","method":"POST","path":"/ai-tenant-e2e-shared-a-644efc/rate-test-model-644efc/v1/completions","host":"e2e-shared-a-644efc.apps.73972a97-1adb-4b97-ac41-1111e9d9a3d1.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T21:45:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9870a0bc-9b09-4e8e-a320-3829b5d0d5e8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.13:44316","PortSpecifier":{"PortValue":44316}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784756739,"nanos":249917186},"http":{"id":"9870a0bc-9b09-4e8e-a320-3829b5d0d5e8","method":"POST","headers":{":authority":"e2e-shared-a-644efc.apps.73972a97-1adb-4b97-ac41-1111e9d9a3d1.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-644efc/rate-test-model-644efc/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T21:45:39Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9870a0bc-9b09-4e8e-a320-3829b5d0d5e8","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-UdhVduUoRYcP00G1_Pzk8RVZqqXTuHmdniEIGK7EB7tuH3X7No50KEElt0HG"}
{"level":"debug","ts":"2026-07-22T21:45:39Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9870a0bc-9b09-4e8e-a320-3829b5d0d5e8","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-644efc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-UdhVduUoRYcP00G1_Pzk8RVZqqXTuHmdniEIGK7EB7tuH3X7No50KEElt0HG\"}"}
{"level":"debug","ts":"2026-07-22T21:45:39Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9870a0bc-9b09-4e8e-a320-3829b5d0d5e8","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-644efc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"936913ad-8df9-4076-8f50-17c7b464ea11","keyName":"e2e-rate-a-5cce46","subscription":"e2e-rate-iso-a-5cce46","tenant":"e2e-shared-a-644efc","userId":"936913ad-8df9-4076-8f50-17c7b464ea11","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-22T21:45:39Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9870a0bc-9b09-4e8e-a320-3829b5d0d5e8","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-644efc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-644efc/rate-test-model-644efc\",\"requestedSubscription\":\"e2e-rate-iso-a-5cce46\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-22T21:45:39Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9870a0bc-9b09-4e8e-a320-3829b5d0d5e8","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-644efc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-644efc","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-5cce46","namespace":"ai-tenant-e2e-shared-a-644efc","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-644efc/rate-test-model-644efc"}}
{"level":"debug","ts":"2026-07-22T21:45:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9870a0bc-9b09-4e8e-a320-3829b5d0d5e8","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T21:45:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9870a0bc-9b09-4e8e-a320-3829b5d0d5e8","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T21:45:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9870a0bc-9b09-4e8e-a320-3829b5d0d5e8","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T21:45:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9870a0bc-9b09-4e8e-a320-3829b5d0d5e8","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-644efc/rate-test-model-644efc\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-644efc/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T21:45:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9870a0bc-9b09-4e8e-a320-3829b5d0d5e8","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T21:45:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9870a0bc-9b09-4e8e-a320-3829b5d0d5e8","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T21:45:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9870a0bc-9b09-4e8e-a320-3829b5d0d5e8","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-5cce46"}
{"level":"debug","ts":"2026-07-22T21:45:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9870a0bc-9b09-4e8e-a320-3829b5d0d5e8","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T21:45:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9870a0bc-9b09-4e8e-a320-3829b5d0d5e8","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"936913ad-8df9-4076-8f50-17c7b464ea11","keyName":"e2e-rate-a-5cce46","selected_subscription":"e2e-rate-iso-a-5cce46","selected_subscription_key":"ai-tenant-e2e-shared-a-644efc/e2e-rate-iso-a-5cce46@ai-tenant-e2e-shared-a-644efc/rate-test-model-644efc","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-644efc","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-5cce46","namespace":"ai-tenant-e2e-shared-a-644efc","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-644efc/rate-test-model-644efc"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-22T21:45:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9870a0bc-9b09-4e8e-a320-3829b5d0d5e8","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T21:45:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9870a0bc-9b09-4e8e-a320-3829b5d0d5e8","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T21:45:48Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3a0a32ba-2975-422b-9535-72304a7c80d6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.13:54894","PortSpecifier":{"PortValue":54894}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3a0a32ba-2975-422b-9535-72304a7c80d6","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-644efc.apps.73972a97-1adb-4b97-ac41-1111e9d9a3d1.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T21:45:48Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3a0a32ba-2975-422b-9535-72304a7c80d6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.13:54894","PortSpecifier":{"PortValue":54894}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784756748,"nanos":35206981},"http":{"id":"3a0a32ba-2975-422b-9535-72304a7c80d6","method":"POST","headers":{":authority":"e2e-shared-a-644efc.apps.73972a97-1adb-4b97-ac41-1111e9d9a3d1.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T21:45:48Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"3a0a32ba-2975-422b-9535-72304a7c80d6","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-22T21:45:48Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3a0a32ba-2975-422b-9535-72304a7c80d6","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"4a2ac7de-4c49-47a1-bc49-f73ac1757acf","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=21c673dc-657d-4dfc-b73c-396658381b0a"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1111e9d9a3d1"]}}
{"level":"debug","ts":"2026-07-22T21:45:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3a0a32ba-2975-422b-9535-72304a7c80d6","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1111e9d9a3d1"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=21c673dc-657d-4dfc-b73c-396658381b0a"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"4a2ac7de-4c49-47a1-bc49-f73ac1757acf","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"ee0c6a27096f2e3b909d04b0370952da484d0ab0f61483103d65fc880890fdee"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.49:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-644efc.apps.73972a97-1adb-4b97-ac41-1111e9d9a3d1.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T21:45:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3a0a32ba-2975-422b-9535-72304a7c80d6","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T21:45:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3a0a32ba-2975-422b-9535-72304a7c80d6","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T21:45:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3a0a32ba-2975-422b-9535-72304a7c80d6","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-644efc/rate-test-model-644efc\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-644efc/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T21:45:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"3a0a32ba-2975-422b-9535-72304a7c80d6","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-22T21:45:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3a0a32ba-2975-422b-9535-72304a7c80d6","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T21:45:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3a0a32ba-2975-422b-9535-72304a7c80d6","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-22T21:45:48Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3a0a32ba-2975-422b-9535-72304a7c80d6","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T21:45:48Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3a0a32ba-2975-422b-9535-72304a7c80d6","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T21:45:48Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8fb853c1-7a57-4704-a450-f39db773ad13","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.13:44910","PortSpecifier":{"PortValue":44910}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.50:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"8fb853c1-7a57-4704-a450-f39db773ad13","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-bfd0ef.apps.73972a97-1adb-4b97-ac41-1111e9d9a3d1.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T21:45:48Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8fb853c1-7a57-4704-a450-f39db773ad13","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.13:44910","PortSpecifier":{"PortValue":44910}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.50:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784756748,"nanos":79831187},"http":{"id":"8fb853c1-7a57-4704-a450-f39db773ad13","method":"POST","headers":{":authority":"e2e-shared-b-bfd0ef.apps.73972a97-1adb-4b97-ac41-1111e9d9a3d1.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T21:45:48Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"8fb853c1-7a57-4704-a450-f39db773ad13","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-22T21:45:48Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"8fb853c1-7a57-4704-a450-f39db773ad13","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"4a2ac7de-4c49-47a1-bc49-f73ac1757acf","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=21c673dc-657d-4dfc-b73c-396658381b0a"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1111e9d9a3d1"]}}
{"level":"debug","ts":"2026-07-22T21:45:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"8fb853c1-7a57-4704-a450-f39db773ad13","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1111e9d9a3d1"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=21c673dc-657d-4dfc-b73c-396658381b0a"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"4a2ac7de-4c49-47a1-bc49-f73ac1757acf","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"ce4dd60950e836d1bf731b644c1cdfe6ce8c9b47881f962d74017bf59057d6de"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.50:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-bfd0ef.apps.73972a97-1adb-4b97-ac41-1111e9d9a3d1.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T21:45:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8fb853c1-7a57-4704-a450-f39db773ad13","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T21:45:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8fb853c1-7a57-4704-a450-f39db773ad13","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T21:45:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8fb853c1-7a57-4704-a450-f39db773ad13","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-bfd0ef/rate-test-model-bfd0ef\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-bfd0ef/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T21:45:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"8fb853c1-7a57-4704-a450-f39db773ad13","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-22T21:45:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8fb853c1-7a57-4704-a450-f39db773ad13","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T21:45:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8fb853c1-7a57-4704-a450-f39db773ad13","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-22T21:45:48Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8fb853c1-7a57-4704-a450-f39db773ad13","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T21:45:48Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8fb853c1-7a57-4704-a450-f39db773ad13","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T21:45:48Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4244ff88-83bf-4178-8552-6763fa7c4ffa","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.13:54896","PortSpecifier":{"PortValue":54896}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"4244ff88-83bf-4178-8552-6763fa7c4ffa","method":"POST","path":"/ai-tenant-e2e-shared-a-644efc/rate-test-model-644efc/v1/completions","host":"e2e-shared-a-644efc.apps.73972a97-1adb-4b97-ac41-1111e9d9a3d1.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T21:45:48Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4244ff88-83bf-4178-8552-6763fa7c4ffa","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.13:54896","PortSpecifier":{"PortValue":54896}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784756748,"nanos":120617080},"http":{"id":"4244ff88-83bf-4178-8552-6763fa7c4ffa","method":"POST","headers":{":authority":"e2e-shared-a-644efc.apps.73972a97-1adb-4b97-ac41-1111e9d9a3d1.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-644efc/rate-test-model-644efc/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T21:45:48Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"4244ff88-83bf-4178-8552-6763fa7c4ffa","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-u43NliEskyGbP0hN_KwI9ME93jsNoG1qNqZNxhZXauc3lphm77Y2ZkYOCyC1"}
{"level":"debug","ts":"2026-07-22T21:45:48Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"4244ff88-83bf-4178-8552-6763fa7c4ffa","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-644efc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-u43NliEskyGbP0hN_KwI9ME93jsNoG1qNqZNxhZXauc3lphm77Y2ZkYOCyC1\"}"}
{"level":"debug","ts":"2026-07-22T21:45:48Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"4244ff88-83bf-4178-8552-6763fa7c4ffa","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-644efc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"372b3960-683c-42ec-a8dc-c7c7118ad245","keyName":"e2e-rate-a-ed6705","subscription":"e2e-rate-iso-a-ed6705","tenant":"e2e-shared-a-644efc","userId":"372b3960-683c-42ec-a8dc-c7c7118ad245","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-22T21:45:48Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"4244ff88-83bf-4178-8552-6763fa7c4ffa","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-644efc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-644efc/rate-test-model-644efc\",\"requestedSubscription\":\"e2e-rate-iso-a-ed6705\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-22T21:45:48Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"4244ff88-83bf-4178-8552-6763fa7c4ffa","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-644efc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-644efc","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-ed6705","namespace":"ai-tenant-e2e-shared-a-644efc","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-644efc/rate-test-model-644efc"}}
{"level":"debug","ts":"2026-07-22T21:45:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"4244ff88-83bf-4178-8552-6763fa7c4ffa","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T21:45:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4244ff88-83bf-4178-8552-6763fa7c4ffa","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T21:45:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4244ff88-83bf-4178-8552-6763fa7c4ffa","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T21:45:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4244ff88-83bf-4178-8552-6763fa7c4ffa","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-644efc/rate-test-model-644efc\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-644efc/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T21:45:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4244ff88-83bf-4178-8552-6763fa7c4ffa","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T21:45:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4244ff88-83bf-4178-8552-6763fa7c4ffa","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T21:45:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4244ff88-83bf-4178-8552-6763fa7c4ffa","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T21:45:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4244ff88-83bf-4178-8552-6763fa7c4ffa","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-ed6705"}
{"level":"debug","ts":"2026-07-22T21:45:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4244ff88-83bf-4178-8552-6763fa7c4ffa","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"372b3960-683c-42ec-a8dc-c7c7118ad245","keyName":"e2e-rate-a-ed6705","selected_subscription":"e2e-rate-iso-a-ed6705","selected_subscription_key":"ai-tenant-e2e-shared-a-644efc/e2e-rate-iso-a-ed6705@ai-tenant-e2e-shared-a-644efc/rate-test-model-644efc","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-644efc","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-ed6705","namespace":"ai-tenant-e2e-shared-a-644efc","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-644efc/rate-test-model-644efc"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-22T21:45:48Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4244ff88-83bf-4178-8552-6763fa7c4ffa","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T21:45:48Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4244ff88-83bf-4178-8552-6763fa7c4ffa","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T21:45:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f2a2727b-ad9c-44fd-bd5c-ebe6f5a7ef14","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.13:54900","PortSpecifier":{"PortValue":54900}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f2a2727b-ad9c-44fd-bd5c-ebe6f5a7ef14","method":"POST","path":"/ai-tenant-e2e-shared-a-644efc/rate-test-model-644efc/v1/completions","host":"e2e-shared-a-644efc.apps.73972a97-1adb-4b97-ac41-1111e9d9a3d1.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T21:45:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f2a2727b-ad9c-44fd-bd5c-ebe6f5a7ef14","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.13:54900","PortSpecifier":{"PortValue":54900}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784756749,"nanos":165897448},"http":{"id":"f2a2727b-ad9c-44fd-bd5c-ebe6f5a7ef14","method":"POST","headers":{":authority":"e2e-shared-a-644efc.apps.73972a97-1adb-4b97-ac41-1111e9d9a3d1.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-644efc/rate-test-model-644efc/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T21:45:49Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f2a2727b-ad9c-44fd-bd5c-ebe6f5a7ef14","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-u43NliEskyGbP0hN_KwI9ME93jsNoG1qNqZNxhZXauc3lphm77Y2ZkYOCyC1"}
{"level":"debug","ts":"2026-07-22T21:45:49Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f2a2727b-ad9c-44fd-bd5c-ebe6f5a7ef14","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-644efc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-u43NliEskyGbP0hN_KwI9ME93jsNoG1qNqZNxhZXauc3lphm77Y2ZkYOCyC1\"}"}
{"level":"debug","ts":"2026-07-22T21:45:49Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f2a2727b-ad9c-44fd-bd5c-ebe6f5a7ef14","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-644efc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"372b3960-683c-42ec-a8dc-c7c7118ad245","keyName":"e2e-rate-a-ed6705","subscription":"e2e-rate-iso-a-ed6705","tenant":"e2e-shared-a-644efc","userId":"372b3960-683c-42ec-a8dc-c7c7118ad245","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-22T21:45:49Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f2a2727b-ad9c-44fd-bd5c-ebe6f5a7ef14","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-644efc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-644efc/rate-test-model-644efc\",\"requestedSubscription\":\"e2e-rate-iso-a-ed6705\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-22T21:45:49Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f2a2727b-ad9c-44fd-bd5c-ebe6f5a7ef14","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-644efc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-644efc","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-ed6705","namespace":"ai-tenant-e2e-shared-a-644efc","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-644efc/rate-test-model-644efc"}}
{"level":"debug","ts":"2026-07-22T21:45:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f2a2727b-ad9c-44fd-bd5c-ebe6f5a7ef14","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T21:45:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f2a2727b-ad9c-44fd-bd5c-ebe6f5a7ef14","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T21:45:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f2a2727b-ad9c-44fd-bd5c-ebe6f5a7ef14","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T21:45:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f2a2727b-ad9c-44fd-bd5c-ebe6f5a7ef14","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T21:45:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f2a2727b-ad9c-44fd-bd5c-ebe6f5a7ef14","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-644efc/rate-test-model-644efc\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-644efc/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T21:45:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f2a2727b-ad9c-44fd-bd5c-ebe6f5a7ef14","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T21:45:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f2a2727b-ad9c-44fd-bd5c-ebe6f5a7ef14","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-ed6705"}
{"level":"debug","ts":"2026-07-22T21:45:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f2a2727b-ad9c-44fd-bd5c-ebe6f5a7ef14","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T21:45:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f2a2727b-ad9c-44fd-bd5c-ebe6f5a7ef14","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"372b3960-683c-42ec-a8dc-c7c7118ad245","keyName":"e2e-rate-a-ed6705","selected_subscription":"e2e-rate-iso-a-ed6705","selected_subscription_key":"ai-tenant-e2e-shared-a-644efc/e2e-rate-iso-a-ed6705@ai-tenant-e2e-shared-a-644efc/rate-test-model-644efc","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-644efc","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-ed6705","namespace":"ai-tenant-e2e-shared-a-644efc","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-644efc/rate-test-model-644efc"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-22T21:45:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f2a2727b-ad9c-44fd-bd5c-ebe6f5a7ef14","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T21:45:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f2a2727b-ad9c-44fd-bd5c-ebe6f5a7ef14","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T21:45:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"26804951-5cef-4532-8aa1-06a40da41b60","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.13:54914","PortSpecifier":{"PortValue":54914}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"26804951-5cef-4532-8aa1-06a40da41b60","method":"POST","path":"/ai-tenant-e2e-shared-a-644efc/rate-test-model-644efc/v1/completions","host":"e2e-shared-a-644efc.apps.73972a97-1adb-4b97-ac41-1111e9d9a3d1.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T21:45:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"26804951-5cef-4532-8aa1-06a40da41b60","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.13:54914","PortSpecifier":{"PortValue":54914}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784756750,"nanos":200975114},"http":{"id":"26804951-5cef-4532-8aa1-06a40da41b60","method":"POST","headers":{":authority":"e2e-shared-a-644efc.apps.73972a97-1adb-4b97-ac41-1111e9d9a3d1.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-644efc/rate-test-model-644efc/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T21:45:50Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"26804951-5cef-4532-8aa1-06a40da41b60","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-u43NliEskyGbP0hN_KwI9ME93jsNoG1qNqZNxhZXauc3lphm77Y2ZkYOCyC1"}
{"level":"debug","ts":"2026-07-22T21:45:50Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"26804951-5cef-4532-8aa1-06a40da41b60","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-644efc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-u43NliEskyGbP0hN_KwI9ME93jsNoG1qNqZNxhZXauc3lphm77Y2ZkYOCyC1\"}"}
{"level":"debug","ts":"2026-07-22T21:45:50Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"26804951-5cef-4532-8aa1-06a40da41b60","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-644efc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"372b3960-683c-42ec-a8dc-c7c7118ad245","keyName":"e2e-rate-a-ed6705","subscription":"e2e-rate-iso-a-ed6705","tenant":"e2e-shared-a-644efc","userId":"372b3960-683c-42ec-a8dc-c7c7118ad245","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-22T21:45:50Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"26804951-5cef-4532-8aa1-06a40da41b60","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-644efc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-644efc/rate-test-model-644efc\",\"requestedSubscription\":\"e2e-rate-iso-a-ed6705\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-22T21:45:50Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"26804951-5cef-4532-8aa1-06a40da41b60","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-644efc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-644efc","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-ed6705","namespace":"ai-tenant-e2e-shared-a-644efc","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-644efc/rate-test-model-644efc"}}
{"level":"debug","ts":"2026-07-22T21:45:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"26804951-5cef-4532-8aa1-06a40da41b60","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T21:45:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"26804951-5cef-4532-8aa1-06a40da41b60","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T21:45:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"26804951-5cef-4532-8aa1-06a40da41b60","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T21:45:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"26804951-5cef-4532-8aa1-06a40da41b60","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-644efc/rate-test-model-644efc\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-644efc/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T21:45:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"26804951-5cef-4532-8aa1-06a40da41b60","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T21:45:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"26804951-5cef-4532-8aa1-06a40da41b60","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T21:45:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"26804951-5cef-4532-8aa1-06a40da41b60","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T21:45:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"26804951-5cef-4532-8aa1-06a40da41b60","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-ed6705"}
{"level":"debug","ts":"2026-07-22T21:45:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"26804951-5cef-4532-8aa1-06a40da41b60","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"372b3960-683c-42ec-a8dc-c7c7118ad245","keyName":"e2e-rate-a-ed6705","selected_subscription":"e2e-rate-iso-a-ed6705","selected_subscription_key":"ai-tenant-e2e-shared-a-644efc/e2e-rate-iso-a-ed6705@ai-tenant-e2e-shared-a-644efc/rate-test-model-644efc","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-644efc","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-ed6705","namespace":"ai-tenant-e2e-shared-a-644efc","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-644efc/rate-test-model-644efc"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-22T21:45:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"26804951-5cef-4532-8aa1-06a40da41b60","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T21:45:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"26804951-5cef-4532-8aa1-06a40da41b60","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T21:45:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"261a5645-fd86-47ae-bc41-bfb8abadac42","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.13:44918","PortSpecifier":{"PortValue":44918}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.50:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"261a5645-fd86-47ae-bc41-bfb8abadac42","method":"POST","path":"/ai-tenant-e2e-shared-b-bfd0ef/rate-test-model-bfd0ef/v1/completions","host":"e2e-shared-b-bfd0ef.apps.73972a97-1adb-4b97-ac41-1111e9d9a3d1.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T21:45:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"261a5645-fd86-47ae-bc41-bfb8abadac42","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.13:44918","PortSpecifier":{"PortValue":44918}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.50:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784756750,"nanos":237984517},"http":{"id":"261a5645-fd86-47ae-bc41-bfb8abadac42","method":"POST","headers":{":authority":"e2e-shared-b-bfd0ef.apps.73972a97-1adb-4b97-ac41-1111e9d9a3d1.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-bfd0ef/rate-test-model-bfd0ef/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T21:45:50Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"261a5645-fd86-47ae-bc41-bfb8abadac42","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-12Y0vU2L0WE449108_lyzjz3gHgA2QgLNeDdvHvx7WHEV2CzOSk9J10jRNHmR"}
{"level":"debug","ts":"2026-07-22T21:45:50Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"261a5645-fd86-47ae-bc41-bfb8abadac42","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-bfd0ef.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-12Y0vU2L0WE449108_lyzjz3gHgA2QgLNeDdvHvx7WHEV2CzOSk9J10jRNHmR\"}"}
{"level":"debug","ts":"2026-07-22T21:45:50Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"261a5645-fd86-47ae-bc41-bfb8abadac42","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-bfd0ef.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"72b5fb28-0e89-4f51-88a3-717720699fd5","keyName":"e2e-rate-b-ed6705","subscription":"e2e-rate-iso-b-ed6705","tenant":"e2e-shared-b-bfd0ef","userId":"72b5fb28-0e89-4f51-88a3-717720699fd5","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-22T21:45:50Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"261a5645-fd86-47ae-bc41-bfb8abadac42","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-bfd0ef.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-bfd0ef/rate-test-model-bfd0ef\",\"requestedSubscription\":\"e2e-rate-iso-b-ed6705\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-22T21:45:50Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"261a5645-fd86-47ae-bc41-bfb8abadac42","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-bfd0ef.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-bfd0ef","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-ed6705","namespace":"ai-tenant-e2e-shared-b-bfd0ef","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-b-bfd0ef/rate-test-model-bfd0ef"}}
{"level":"debug","ts":"2026-07-22T21:45:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"261a5645-fd86-47ae-bc41-bfb8abadac42","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T21:45:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"261a5645-fd86-47ae-bc41-bfb8abadac42","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T21:45:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"261a5645-fd86-47ae-bc41-bfb8abadac42","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T21:45:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"261a5645-fd86-47ae-bc41-bfb8abadac42","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-bfd0ef/rate-test-model-bfd0ef\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-bfd0ef/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T21:45:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"261a5645-fd86-47ae-bc41-bfb8abadac42","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T21:45:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"261a5645-fd86-47ae-bc41-bfb8abadac42","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T21:45:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"261a5645-fd86-47ae-bc41-bfb8abadac42","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-ed6705"}
{"level":"debug","ts":"2026-07-22T21:45:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"261a5645-fd86-47ae-bc41-bfb8abadac42","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T21:45:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"261a5645-fd86-47ae-bc41-bfb8abadac42","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"72b5fb28-0e89-4f51-88a3-717720699fd5","keyName":"e2e-rate-b-ed6705","selected_subscription":"e2e-rate-iso-b-ed6705","selected_subscription_key":"ai-tenant-e2e-shared-b-bfd0ef/e2e-rate-iso-b-ed6705@ai-tenant-e2e-shared-b-bfd0ef/rate-test-model-bfd0ef","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-bfd0ef","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-ed6705","namespace":"ai-tenant-e2e-shared-b-bfd0ef","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-b-bfd0ef/rate-test-model-bfd0ef"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-22T21:45:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"261a5645-fd86-47ae-bc41-bfb8abadac42","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T21:45:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"261a5645-fd86-47ae-bc41-bfb8abadac42","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T21:45:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e9a94ccbb57a434a0850bdc1965d2b9cb29290f4be2c1265971c3bb70f812086"}
{"level":"info","ts":"2026-07-22T21:45:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ac4ab70ed3605049b573dfbbc0e020e8d8ef2c7be347ad508d5901c6026fcbd9"}
{"level":"info","ts":"2026-07-22T21:45:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ce4dd60950e836d1bf731b644c1cdfe6ce8c9b47881f962d74017bf59057d6de"}
{"level":"info","ts":"2026-07-22T21:45:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3d4193039f937e930003ad43ffb4b0a7f31d0bf22628089825c173cf54fb412c"}
{"level":"info","ts":"2026-07-22T21:45:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/51ddda10a15259e48ab962b57323d9d819dcdad5820d126e11c43d919b6adda5"}
{"level":"info","ts":"2026-07-22T21:45:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9354acbf0065c1ebdc9f059629e0503ebcfc62cc1ba4421302a0706c5970649a"}
{"level":"info","ts":"2026-07-22T21:45:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ee0c6a27096f2e3b909d04b0370952da484d0ab0f61483103d65fc880890fdee"}
{"level":"info","ts":"2026-07-22T21:45:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c2967f23a15fa6afbc595e7b482370d663ac4f9b56f0e439fa44a2593cc64158"}
{"level":"info","ts":"2026-07-22T21:45:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/0383cdcd7b481b718641545bfbbbe827b5ec1e2fb271d9b468829fac739bab02"}
{"level":"info","ts":"2026-07-22T21:45:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b2d77b6d99a7ca285cc673a1e5ce70089ecc14fb3b109dd57b3c219569bcce51"}
{"level":"info","ts":"2026-07-22T21:45:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c7b37cd6afbbcea9b7230155a67ac47bfe68b323655bd123358b1171370da43f"}
{"level":"info","ts":"2026-07-22T21:45:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d92a05080444b32dce0e88225162985df456f526ddd9fa024577ec8700eb258d"}
{"level":"info","ts":"2026-07-22T21:45:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/5e6ba05e61dc00a61f0c78af217193bdbb8fb6fe5c7f8b6628c7992701f263a8"}
{"level":"info","ts":"2026-07-22T21:45:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/8e1bf902f300790503d4794e894e9cecf53d423625f748fef83ace3a460c4033"}
{"level":"info","ts":"2026-07-22T21:45:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6ddd63f7ba2830a19b5c46cec643aafb070a6dd210268ddd3488b6fdc7dbde55"}
{"level":"info","ts":"2026-07-22T21:45:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c3e201d828a398919aaa50bacf6b9f4c50bd08f2e2d5c6ad7cf19937643e457f"}
{"level":"info","ts":"2026-07-22T21:45:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c6d9f28f619f2cbc796cf005a7c24a188aa6fb42151d34233addf55d07fe142e"}
{"level":"info","ts":"2026-07-22T21:45:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/db5f971ce0b96e284c81a1ea4af3856b128bb6b1ba8e0a31338c85263a4546c3"}
{"level":"info","ts":"2026-07-22T21:45:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/137e909fd2601bb3568b5ec3419be4abf2178f7e458dc310c35bf77b72b246f8"}
{"level":"info","ts":"2026-07-22T21:45:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6ce6b40092bfb7b9cdf870df11fa9eaef91cebaeab01e2ce5b4ff53225f1921b"}
{"level":"info","ts":"2026-07-22T21:45:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/8edf88dfcb8d164f1a5072e14f8425b790775decb520ba3299afb431d26ee8d4"}
{"level":"info","ts":"2026-07-22T21:45:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/efdf1904bc2767b639409c069a0d6012a87176ea9cd4d7e6d383245e70adab93"}
{"level":"info","ts":"2026-07-22T21:45:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3ed3fe5726c461472bbd29142eba8dcd1f09051e52e6974b3c6f3de42bfcff5c"}
{"level":"info","ts":"2026-07-22T21:45:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c34da97cb7d94945e6f6b08d53035bebe90aebe70a31827fba117a1f4b426788"}