{"level":"error","ts":"2026-07-08T12:35:09.857Z","logger":"kuadrant-operator.HTTPRoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"maas-api-route-e2e-inf-a-253a40","namespace":"odh-ai-gateway-infra","uid":"70f5e7c0-518e-420f-bf79-3fd9c6bb4282","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"maas-api-route-e2e-inf-a-253a40\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-08T12:35:09.942Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-inf-a-253a40","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-inf-a-253a40\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-08T12:35:09.952Z","logger":"kuadrant-operator.HTTPRoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"test-model-253a40-kserve-route","namespace":"ai-tenant-e2e-inf-a-253a40","uid":"3f6969d0-7806-4a60-975c-9f0460ce3bd1","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"test-model-253a40-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-08T12:35:12.952Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["WasmPlugin","AuthConfig","TokenRateLimitPolicy","AuthPolicy","HTTPRoute","Gateway","Limitador","EnvoyFilter","ConfigMap"],"eventTypes":{"create":13,"update":12}}
{"level":"info","ts":"2026-07-08T12:35:13.053Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-08T12:35:13.064Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-08T12:35:13.143Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-08T12:35:13.143Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-08T12:35:14.042Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-08T12:35:14.042Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-08T12:35:14.142Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-08T12:35:14.152Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-07-08T12:35:14.152Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-08T12:35:14.443Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-08T12:35:14.652Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-08T12:35:16.061Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-08T12:35:16.553Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-08T12:35:17.959Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","ConfigMap","Limitador","AuthPolicy"],"eventTypes":{"update":7}}
{"level":"info","ts":"2026-07-08T12:35:18.043Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-08T12:35:18.051Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-08T12:35:18.342Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-08T12:35:18.342Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-08T12:35:18.941Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-08T12:35:18.942Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-08T12:35:19.041Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-08T12:35:19.051Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-07-08T12:35:19.051Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-08T12:35:19.142Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-08T12:35:19.345Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-08T12:35:20.879Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-08T12:35:21.555Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-08T12:35:31.153Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","HTTPRoute","Gateway"],"eventTypes":{"create":1,"update":2}}
{"level":"info","ts":"2026-07-08T12:35:32.241Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-08T12:35:32.242Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-08T12:35:32.341Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-08T12:35:32.352Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-07-08T12:35:32.442Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-08T12:35:32.450Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-08T12:35:32.544Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-08T12:35:34.083Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-08T12:35:34.551Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-08T12:35:37.550Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["HTTPRoute","AuthPolicy","TokenRateLimitPolicy","WasmPlugin","Limitador","ConfigMap"],"eventTypes":{"create":2,"update":8}}
{"level":"info","ts":"2026-07-08T12:35:37.566Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-08T12:35:38.043Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-08T12:35:38.342Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-08T12:35:38.343Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-08T12:35:38.741Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-08T12:35:38.751Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-08T12:35:38.848Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-08T12:35:38.848Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-08T12:35:39.350Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-08T12:35:39.543Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"error","ts":"2026-07-08T12:35:39.647Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-08T12:35:39.647Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-08T12:35:41.601Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-08T12:35:42.358Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-08T12:35:45.758Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["HTTPRoute","AuthConfig","EnvoyFilter","Gateway","WasmPlugin","AuthPolicy","TokenRateLimitPolicy","Limitador","ConfigMap"],"eventTypes":{"create":13,"update":9}}
{"level":"info","ts":"2026-07-08T12:35:45.773Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-08T12:35:46.446Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-08T12:35:46.642Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-08T12:35:46.642Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-08T12:35:46.942Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-08T12:35:46.942Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-08T12:35:47.041Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-08T12:35:47.853Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-08T12:35:47.946Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-08T12:35:48.045Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-07-08T12:35:48.147Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-08T12:35:49.865Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-08T12:35:50.248Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-08T12:35:51.953Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Limitador","ConfigMap","AuthPolicy"],"eventTypes":{"update":3}}
{"level":"info","ts":"2026-07-08T12:35:51.968Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-08T12:35:52.348Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-08T12:35:52.742Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-08T12:35:52.742Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-08T12:35:53.042Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-08T12:35:53.042Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-08T12:35:53.141Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-08T12:35:53.745Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-07-08T12:35:53.745Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-08T12:35:53.944Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-08T12:35:53.947Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-08T12:35:56.259Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-08T12:35:56.743Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-08T12:35:58.556Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","Limitador","ConfigMap"],"eventTypes":{"update":11}}
{"level":"info","ts":"2026-07-08T12:35:58.572Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-08T12:35:59.346Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-08T12:35:59.453Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-08T12:35:59.453Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-08T12:35:59.550Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-08T12:35:59.550Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-08T12:35:59.642Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-08T12:35:59.743Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-07-08T12:35:59.743Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-08T12:35:59.944Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-08T12:36:01.453Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-08T12:36:02.057Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-08T12:36:19.546Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","TokenRateLimitPolicy"],"eventTypes":{"delete":1,"update":6}}
{"level":"info","ts":"2026-07-08T12:36:20.448Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-08T12:36:20.542Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-08T12:36:20.542Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-08T12:36:20.642Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-07-08T12:36:20.652Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-08T12:36:21.759Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","HTTPRoute","TokenRateLimitPolicy"],"eventTypes":{"delete":4,"update":2}}
{"level":"info","ts":"2026-07-08T12:36:22.551Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-08T12:36:22.641Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-08T12:36:22.642Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-08T12:36:22.653Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"error","ts":"2026-07-08T12:36:22.947Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-ratelimiting-e2e-inf-a-253a40","error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-inf-a-253a40\" not found"}
{"level":"info","ts":"2026-07-08T12:36:23.143Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-08T12:36:23.154Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"error","ts":"2026-07-08T12:36:23.243Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-08T12:36:23.243Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-07-08T12:36:23.461Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update wasmplugin object","gateway":"openshift-ingress/e2e-inf-b-85707a","wasmplugin":{"apiVersion":"extensions.istio.io/v1alpha1","kind":"WasmPlugin","metadata":{"creationTimestamp":"2026-07-08T12:34:49Z","generation":3,"labels":{"kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"extensions.istio.io/v1alpha1","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"84c2c5c7-0c48-4435-8799-c54d33536e64\"}":{}}},"f:spec":{".":{},"f:phase":{},"f:pluginConfig":{".":{},"f:actionSets":{},"f:services":{".":{},"f:auth-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}},"f:ratelimit-check-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}},"f:ratelimit-report-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}},"f:ratelimit-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}}}},"f:targetRefs":{},"f:url":{}}},"manager":"manager","operation":"Update","time":"2026-07-08T12:35:40Z"}],"name":"kuadrant-e2e-inf-b-85707a","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-inf-b-85707a","uid":"84c2c5c7-0c48-4435-8799-c54d33536e64"}],"resourceVersion":"48451","uid":"4434d384-ae85-43fb-94aa-d3e8e2a5ae41"},"spec":{"phase":"STATS","pluginConfig":{"actionSets":[{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"af9fdef0a6b1da09bea99e7998fd689379f72c72282b6571749657ebfb88872a","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-inf-b-85707a-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__2b040aa8","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-85707a","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-85707a"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__2b040aa8","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-85707a","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-85707a"]}],"name":"7832f73547d4138a693cf976646fad02bacce0ef78760aee777410c50f22f02d","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/v1/subscriptions')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"1a0483e5d5113b2e86ebaa502926159fadd0593ba50c47215b910354d6242ab7","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-inf-b-85707a-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__2b040aa8","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-85707a","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-85707a"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__2b040aa8","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-85707a","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-85707a"]}],"name":"1f53c420db381442bc0f6dd83917d119d09f82924ac91affdab2bd24c4caee7b","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/v1/api-keys')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"8cc9d228cf2a49f01e6018223328beab62573af9a862060650820e29a1036c98","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-inf-b-85707a-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__2b040aa8","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-85707a","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-85707a"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__2b040aa8","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-85707a","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-85707a"]}],"name":"47606b860ebdaaf2cc0f879c24d9fd126884c5fb325b61fb059ee82015b8b1ad","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/v1/models')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"bb29d88e72ec9d4e2fe10cb50b6a875210ef93edd7a71a506e241b74786a5062","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-inf-b-85707a-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__2b040aa8","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-85707a","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-85707a"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__2b040aa8","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-85707a","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-85707a"]}],"name":"6aae790b8fc0573d895f224153b7e3248e5a29939e4fe41569c2191296891888","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/maas-api')"]}}],"services":{"auth-service":{"endpoint":"kuadrant-auth-service","failureMode":"deny","timeout":"200ms","type":"auth"},"ratelimit-check-service":{"endpoint":"kuadrant-ratelimit-service","failureMode":"deny","timeout":"100ms","type":"ratelimit-check"},"ratelimit-report-service":{"endpoint":"kuadrant-ratelimit-service","failureMode":"deny","timeout":"100ms","type":"ratelimit-report"},"ratelimit-service":{"endpoint":"kuadrant-ratelimit-service","failureMode":"allow","timeout":"100ms","type":"ratelimit"}}},"targetRefs":[{"group":"gateway.networking.k8s.io","kind":"Gateway","name":"e2e-inf-b-85707a"}],"url":"quay.io/kuadrant/wasm-shim:v0.12.1"},"status":{}},"error":"Operation cannot be fulfilled on wasmplugins.extensions.istio.io \"kuadrant-e2e-inf-b-85707a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-08T12:36:23.542Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to delete wasmplugin object","gateway":"openshift-ingress/e2e-inf-a-253a40","wasmplugin":"openshift-ingress/kuadrant-e2e-inf-a-253a40","error":"wasmplugins.extensions.istio.io \"kuadrant-e2e-inf-a-253a40\" not found"}
{"level":"error","ts":"2026-07-08T12:36:23.849Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-inf-b-85707a","namespace":"openshift-ingress","uid":"a4cd0882-9e31-4f6a-bf49-579ec07a7a68","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-inf-b-85707a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-08T12:36:23.957Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-inf-a-253a40","namespace":"openshift-ingress","uid":"c8e5dc97-364b-4ef6-b67c-1f21c65f51f5","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-inf-a-253a40\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-08T12:36:24.151Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-simulated-simulated-premium","namespace":"llm","uid":"0893bbf0-dbce-4292-8594-200dc25cb63a","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-simulated-simulated-premium\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-08T12:36:24.442Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-facebook-opt-125m-simulated","namespace":"llm","uid":"0667fa6a-f240-4a1e-a116-6b8aa1c9ba93","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-facebook-opt-125m-simulated\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-08T12:36:24.667Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-08T12:36:24.957Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-08T12:36:27.646Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Limitador","TokenRateLimitPolicy","ConfigMap","WasmPlugin","AuthPolicy","AuthConfig","EnvoyFilter"],"eventTypes":{"delete":23,"update":8}}
{"level":"info","ts":"2026-07-08T12:36:27.662Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-08T12:36:27.742Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-08T12:36:27.848Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-08T12:36:27.848Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-08T12:36:28.054Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-08T12:36:28.342Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-08T12:36:28.342Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-08T12:36:28.451Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-07-08T12:36:28.451Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-08T12:36:28.544Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-08T12:36:28.843Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-08T12:36:29.778Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-08T12:36:30.048Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-08T12:36:31.455Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","Limitador","ConfigMap"],"eventTypes":{"update":5}}
{"level":"info","ts":"2026-07-08T12:36:31.471Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-08T12:36:31.547Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-08T12:36:31.847Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-08T12:36:31.847Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-08T12:36:32.144Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-08T12:36:32.144Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-08T12:36:32.241Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-08T12:36:32.248Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-08T12:36:32.249Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-07-08T12:36:32.249Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-08T12:36:33.056Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-08T12:36:33.447Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-08T12:37:03.454Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","AuthPolicy","Gateway"],"eventTypes":{"delete":2,"update":1}}
{"level":"info","ts":"2026-07-08T12:37:04.148Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-08T12:37:04.148Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-08T12:37:04.253Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-08T12:37:04.341Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-08T12:37:04.345Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-08T12:37:04.348Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-07-08T12:37:04.443Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-08T12:37:05.307Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-08T12:37:05.749Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-08T12:37:05.851Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","HTTPRoute"],"eventTypes":{"delete":1,"update":1}}
{"level":"info","ts":"2026-07-08T12:37:06.542Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-08T12:37:06.547Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-08T12:37:06.549Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-07-08T12:37:06.642Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-08T12:37:06.642Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-07-08T12:37:06.651Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/1a0483e5d5113b2e86ebaa502926159fadd0593ba50c47215b910354d6242ab7","error":"authconfigs.authorino.kuadrant.io \"1a0483e5d5113b2e86ebaa502926159fadd0593ba50c47215b910354d6242ab7\" not found"}
{"level":"info","ts":"2026-07-08T12:37:06.754Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-07-08T12:37:06.842Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-auth-e2e-inf-b-85707a","error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-inf-b-85707a\" not found"}
{"level":"error","ts":"2026-07-08T12:37:06.842Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/bb29d88e72ec9d4e2fe10cb50b6a875210ef93edd7a71a506e241b74786a5062","error":"authconfigs.authorino.kuadrant.io \"bb29d88e72ec9d4e2fe10cb50b6a875210ef93edd7a71a506e241b74786a5062\" not found"}
{"level":"error","ts":"2026-07-08T12:37:06.842Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-08T12:37:06.842Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-07-08T12:37:06.944Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/8cc9d228cf2a49f01e6018223328beab62573af9a862060650820e29a1036c98","error":"authconfigs.authorino.kuadrant.io \"8cc9d228cf2a49f01e6018223328beab62573af9a862060650820e29a1036c98\" not found"}
{"level":"error","ts":"2026-07-08T12:37:06.948Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/af9fdef0a6b1da09bea99e7998fd689379f72c72282b6571749657ebfb88872a","error":"authconfigs.authorino.kuadrant.io \"af9fdef0a6b1da09bea99e7998fd689379f72c72282b6571749657ebfb88872a\" not found"}
{"level":"error","ts":"2026-07-08T12:37:06.948Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-ratelimiting-e2e-inf-b-85707a","error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-inf-b-85707a\" not found"}
{"level":"error","ts":"2026-07-08T12:37:06.949Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to delete wasmplugin object","gateway":"openshift-ingress/e2e-inf-b-85707a","wasmplugin":"openshift-ingress/kuadrant-e2e-inf-b-85707a","error":"wasmplugins.extensions.istio.io \"kuadrant-e2e-inf-b-85707a\" not found"}
{"level":"error","ts":"2026-07-08T12:37:07.452Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-simulated-simulated-premium","namespace":"llm","uid":"0893bbf0-dbce-4292-8594-200dc25cb63a","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-simulated-simulated-premium\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-08T12:37:07.452Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-inf-b-85707a-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-inf-b-85707a-maas-auth\" not found"}
{"level":"error","ts":"2026-07-08T12:37:07.562Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-facebook-opt-125m-simulated","namespace":"llm","uid":"0667fa6a-f240-4a1e-a116-6b8aa1c9ba93","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-facebook-opt-125m-simulated\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-08T12:37:07.567Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-inf-a-253a40","namespace":"openshift-ingress","uid":"c8e5dc97-364b-4ef6-b67c-1f21c65f51f5","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-inf-a-253a40\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-08T12:37:07.588Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-inf-b-85707a","namespace":"openshift-ingress","uid":"a4cd0882-9e31-4f6a-bf49-579ec07a7a68","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-inf-b-85707a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-08T12:37:07.588Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-08T12:37:07.755Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-07-08T12:37:07.765Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-inf-b-85707a","error":"gateways.gateway.networking.k8s.io \"e2e-inf-b-85707a\" not found"}
{"level":"info","ts":"2026-07-08T12:37:10.344Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","TokenRateLimitPolicy","ConfigMap","Limitador","AuthConfig","AuthPolicy","EnvoyFilter","WasmPlugin"],"eventTypes":{"create":1,"delete":9,"update":6}}
{"level":"info","ts":"2026-07-08T12:37:10.358Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-08T12:37:10.365Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-08T12:37:10.742Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-08T12:37:10.742Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-08T12:37:11.047Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-08T12:37:11.047Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-08T12:37:11.141Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-08T12:37:11.148Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-07-08T12:37:11.148Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-08T12:37:11.252Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-08T12:37:11.253Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-08T12:37:12.056Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"error","ts":"2026-07-08T12:37:12.143Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-api-a-c1cfd9","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-api-a-c1cfd9\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-08T12:37:12.346Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-08T12:37:12.549Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway"],"eventTypes":{"update":1}}
{"level":"info","ts":"2026-07-08T12:37:13.341Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-08T12:37:13.347Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-08T12:37:13.348Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-07-08T12:37:13.348Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-08T12:37:13.348Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-08T12:37:13.348Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-08T12:37:13.542Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-07-08T12:37:14.150Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-facebook-opt-125m-simulated","namespace":"llm","uid":"0667fa6a-f240-4a1e-a116-6b8aa1c9ba93","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-facebook-opt-125m-simulated\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-08T12:37:14.249Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-simulated-simulated-premium","namespace":"llm","uid":"0893bbf0-dbce-4292-8594-200dc25cb63a","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-simulated-simulated-premium\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-08T12:37:14.300Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-inf-b-85707a","namespace":"openshift-ingress","uid":"a4cd0882-9e31-4f6a-bf49-579ec07a7a68","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-inf-b-85707a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-08T12:37:14.307Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"error","ts":"2026-07-08T12:37:14.345Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-api-a-c1cfd9","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-api-a-c1cfd9\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-08T12:37:14.742Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-08T12:37:17.951Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","TokenRateLimitPolicy","Limitador","HTTPRoute","Gateway"],"eventTypes":{"create":2,"update":6}}
{"level":"info","ts":"2026-07-08T12:37:17.965Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-08T12:37:17.971Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-08T12:37:18.142Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-08T12:37:18.142Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-08T12:37:18.754Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-08T12:37:18.842Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-08T12:37:18.948Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-08T12:37:18.948Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-08T12:37:19.147Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-07-08T12:37:19.243Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-08T12:37:19.344Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-08T12:37:20.580Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"error","ts":"2026-07-08T12:37:20.761Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-api-b-f4d1bb","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-api-b-f4d1bb\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-08T12:37:20.956Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-08T12:37:21.344Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthPolicy","Gateway"],"eventTypes":{"create":2}}
{"level":"info","ts":"2026-07-08T12:37:22.341Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-08T12:37:22.342Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-08T12:37:22.442Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-08T12:37:22.652Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"error","ts":"2026-07-08T12:37:22.842Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-08T12:37:22.842Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-08T12:37:22.845Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-07-08T12:37:22.845Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-api-a-c1cfd9","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"kuadrant-auth-e2e-api-a-c1cfd9","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-api-a-c1cfd9","uid":"8be8009e-f36e-4673-b055-eb8f5b89f1c4"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-auth-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local","port_value":50051}}}}]}]},"name":"kuadrant-auth-service","type":"STRICT_DNS"}}}],"targetRefs":[{"group":"gateway.networking.k8s.io","kind":"Gateway","name":"e2e-api-a-c1cfd9"}]},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-api-a-c1cfd9\" already exists"}
{"level":"error","ts":"2026-07-08T12:37:22.846Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","httpRoute":"odh-ai-gateway-infra/maas-api-route-e2e-api-a-c1cfd9","httpRouteRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-a-c1cfd9#rule-4"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"03552186d44455dbad37c855ef2846376bd1cf96371e6fc8cc8b47f481fd1d71","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer **** sk-oai-\")"}]}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer **** \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"opa":{"rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n"}},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"tenant-gateway-isolation":{"opa":{"rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }"}}},"hosts":["03552186d44455dbad37c855ef2846376bd1cf96371e6fc8cc8b47f481fd1d71"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"request.headers.authorization.replace(\"Bearer **** \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": request.headers.authorization.replace(\"Bearer **** \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-c1cfd9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-c1cfd9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\")) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true}},"headers":{"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? (size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:._/-]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\") || \"x-maas-subscription\" in request.headers"}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** required"}},"unauthorized":{"body":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"Access denied\"","value":null},"code":403,"headers":{"content-type":{"value":"text/plain"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"03552186d44455dbad37c855ef2846376bd1cf96371e6fc8cc8b47f481fd1d71\" already exists"}
{"level":"error","ts":"2026-07-08T12:37:22.942Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","httpRoute":"odh-ai-gateway-infra/maas-api-route-e2e-api-a-c1cfd9","httpRouteRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-a-c1cfd9#rule-2"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"a06542bef29b2a93975e5d0166d7a9db914b2f456b5624fae0c27efe9c2490cd","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer **** sk-oai-\")"}]}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer **** \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"opa":{"rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n"}},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"tenant-gateway-isolation":{"opa":{"rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }"}}},"hosts":["a06542bef29b2a93975e5d0166d7a9db914b2f456b5624fae0c27efe9c2490cd"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"request.headers.authorization.replace(\"Bearer **** \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": request.headers.authorization.replace(\"Bearer **** \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-c1cfd9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-c1cfd9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\")) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true}},"headers":{"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? (size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:._/-]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\") || \"x-maas-subscription\" in request.headers"}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** required"}},"unauthorized":{"body":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"Access denied\"","value":null},"code":403,"headers":{"content-type":{"value":"text/plain"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"a06542bef29b2a93975e5d0166d7a9db914b2f456b5624fae0c27efe9c2490cd\" already exists"}
{"level":"info","ts":"2026-07-08T12:37:23.044Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-07-08T12:37:23.046Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","httpRoute":"odh-ai-gateway-infra/maas-api-route-e2e-api-a-c1cfd9","httpRouteRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-a-c1cfd9#rule-3"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"f909597bb51c84b04b91251130d38e6784c4a1493305573d66cd1943b3fb7095","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer **** sk-oai-\")"}]}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer **** \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"opa":{"rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n"}},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"tenant-gateway-isolation":{"opa":{"rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }"}}},"hosts":["f909597bb51c84b04b91251130d38e6784c4a1493305573d66cd1943b3fb7095"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"request.headers.authorization.replace(\"Bearer **** \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": request.headers.authorization.replace(\"Bearer **** \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-c1cfd9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-c1cfd9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\")) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true}},"headers":{"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? (size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:._/-]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\") || \"x-maas-subscription\" in request.headers"}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** required"}},"unauthorized":{"body":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"Access denied\"","value":null},"code":403,"headers":{"content-type":{"value":"text/plain"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"f909597bb51c84b04b91251130d38e6784c4a1493305573d66cd1943b3fb7095\" already exists"}
{"level":"error","ts":"2026-07-08T12:37:23.057Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-api-a-c1cfd9","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/ratelimit":"true"},"name":"kuadrant-ratelimiting-e2e-api-a-c1cfd9","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-api-a-c1cfd9","uid":"8be8009e-f36e-4673-b055-eb8f5b89f1c4"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"limitador-limitador.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-ratelimit-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"limitador-limitador.kuadrant-system.svc.cluster.local","port_value":8081}}}}]}]},"name":"kuadrant-ratelimit-service","type":"STRICT_DNS"}}}],"targetRefs":[{"group":"gateway.networking.k8s.io","kind":"Gateway","name":"e2e-api-a-c1cfd9"}]},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-api-a-c1cfd9\" already exists"}
{"level":"error","ts":"2026-07-08T12:37:23.066Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","httpRoute":"odh-ai-gateway-infra/maas-api-route-e2e-api-a-c1cfd9","httpRouteRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-a-c1cfd9#rule-1"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"7c6fff72123e9a6b85e8075d0bf089992f50d3b0c14b10cec678c9abc97eb1fa","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer **** sk-oai-\")"}]}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer **** \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"opa":{"rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n"}},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"tenant-gateway-isolation":{"opa":{"rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }"}}},"hosts":["7c6fff72123e9a6b85e8075d0bf089992f50d3b0c14b10cec678c9abc97eb1fa"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"request.headers.authorization.replace(\"Bearer **** \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": request.headers.authorization.replace(\"Bearer **** \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-c1cfd9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-c1cfd9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\")) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true}},"headers":{"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? (size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:._/-]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\") || \"x-maas-subscription\" in request.headers"}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** required"}},"unauthorized":{"body":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"Access denied\"","value":null},"code":403,"headers":{"content-type":{"value":"text/plain"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"7c6fff72123e9a6b85e8075d0bf089992f50d3b0c14b10cec678c9abc97eb1fa\" already exists"}
{"level":"error","ts":"2026-07-08T12:37:23.467Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to create wasmplugin object","gateway":"openshift-ingress/e2e-api-a-c1cfd9","wasmplugin":{"apiVersion":"extensions.istio.io/v1alpha1","kind":"WasmPlugin","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true"},"name":"kuadrant-e2e-api-a-c1cfd9","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-api-a-c1cfd9","uid":"8be8009e-f36e-4673-b055-eb8f5b89f1c4"}]},"spec":{"phase":"STATS","pluginConfig":{"actionSets":[{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"a06542bef29b2a93975e5d0166d7a9db914b2f456b5624fae0c27efe9c2490cd","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-api-a-c1cfd9-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__619eb870","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-api-a-c1cfd9","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-a-c1cfd9"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__619eb870","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-api-a-c1cfd9","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-a-c1cfd9"]}],"name":"a64ec116dd17ce1f53bf1d13df7bd78a84d94bf6272efb58d4f6c209b9224f5a","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/v1/subscriptions')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"f909597bb51c84b04b91251130d38e6784c4a1493305573d66cd1943b3fb7095","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-api-a-c1cfd9-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__619eb870","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-api-a-c1cfd9","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-a-c1cfd9"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__619eb870","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-api-a-c1cfd9","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-a-c1cfd9"]}],"name":"3ba06b3e6fd8250e548f61afb28f7d7c916496a104ce8b9c7aeaeadc5b036479","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/v1/api-keys')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"7c6fff72123e9a6b85e8075d0bf089992f50d3b0c14b10cec678c9abc97eb1fa","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-api-a-c1cfd9-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__619eb870","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-api-a-c1cfd9","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-a-c1cfd9"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__619eb870","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-api-a-c1cfd9","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-a-c1cfd9"]}],"name":"c180eea6128e7eaabe82067efa1519a4ca3943fbfff27393a36e61988b41edad","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/v1/models')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"03552186d44455dbad37c855ef2846376bd1cf96371e6fc8cc8b47f481fd1d71","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-api-a-c1cfd9-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__619eb870","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-api-a-c1cfd9","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-a-c1cfd9"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__619eb870","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-api-a-c1cfd9","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-a-c1cfd9"]}],"name":"aebbe98b911694754905ce83494b819201a5c75f186e0dfa7e4efa020035d70c","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/maas-api')"]}}],"services":{"auth-service":{"endpoint":"kuadrant-auth-service","failureMode":"deny","timeout":"200ms","type":"auth"},"ratelimit-check-service":{"endpoint":"kuadrant-ratelimit-service","failureMode":"deny","timeout":"100ms","type":"ratelimit-check"},"ratelimit-report-service":{"endpoint":"kuadrant-ratelimit-service","failureMode":"deny","timeout":"100ms","type":"ratelimit-report"},"ratelimit-service":{"endpoint":"kuadrant-ratelimit-service","failureMode":"allow","timeout":"100ms","type":"ratelimit"}}},"targetRefs":[{"group":"gateway.networking.k8s.io","kind":"Gateway","name":"e2e-api-a-c1cfd9"}],"url":"quay.io/kuadrant/wasm-shim:v0.12.1"},"status":{}},"error":"wasmplugins.extensions.istio.io \"kuadrant-e2e-api-a-c1cfd9\" already exists"}
{"level":"error","ts":"2026-07-08T12:37:23.742Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-simulated-simulated-premium","namespace":"llm","uid":"0893bbf0-dbce-4292-8594-200dc25cb63a","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-simulated-simulated-premium\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-08T12:37:24.059Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-api-a-c1cfd9","namespace":"openshift-ingress","uid":"20a87e8d-216d-4217-a7a8-fe5220c41f9a","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-api-a-c1cfd9\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-08T12:37:24.142Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-api-a-c1cfd9-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-api-a-c1cfd9-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-08T12:37:24.279Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-facebook-opt-125m-simulated","namespace":"llm","uid":"0667fa6a-f240-4a1e-a116-6b8aa1c9ba93","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-facebook-opt-125m-simulated\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-08T12:37:24.280Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"error","ts":"2026-07-08T12:37:24.287Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-api-b-f4d1bb","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-api-b-f4d1bb\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-08T12:37:24.287Z","logger":"kuadrant-operator.HTTPRoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"maas-api-route-e2e-api-a-c1cfd9","namespace":"odh-ai-gateway-infra","uid":"29b08eb0-39aa-4147-871e-5125f7bb5af7","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"maas-api-route-e2e-api-a-c1cfd9\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-08T12:37:24.449Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-api-a-c1cfd9","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-api-a-c1cfd9\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-08T12:37:24.642Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-08T12:37:27.243Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","HTTPRoute","Gateway","AuthConfig","ConfigMap","WasmPlugin","EnvoyFilter","AuthPolicy","Limitador"],"eventTypes":{"create":10,"update":9}}
{"level":"info","ts":"2026-07-08T12:37:27.257Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-08T12:37:27.347Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-08T12:37:27.542Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-08T12:37:27.542Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-08T12:37:27.746Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-08T12:37:27.953Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-07-08T12:37:28.049Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-07-08T12:37:28.142Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-08T12:37:28.142Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-08T12:37:28.242Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-08T12:37:28.242Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-08T12:37:28.443Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-08T12:37:30.285Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-08T12:37:30.946Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-08T12:37:34.243Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Limitador","AuthPolicy","Gateway","AuthConfig","ConfigMap","HTTPRoute","WasmPlugin","EnvoyFilter","TokenRateLimitPolicy"],"eventTypes":{"create":7,"update":8}}
{"level":"info","ts":"2026-07-08T12:37:34.259Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-08T12:37:34.347Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-08T12:37:34.848Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-08T12:37:34.848Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-08T12:37:35.041Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-08T12:37:35.049Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-07-08T12:37:35.248Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-08T12:37:35.249Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-08T12:37:35.343Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-08T12:37:35.444Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-08T12:37:35.648Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-08T12:37:36.857Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-08T12:37:37.143Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-08T12:37:37.442Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","HTTPRoute"],"eventTypes":{"delete":1,"update":1}}
{"level":"info","ts":"2026-07-08T12:37:38.243Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-08T12:37:38.243Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-08T12:37:38.263Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-08T12:37:38.342Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-08T12:37:38.650Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"error","ts":"2026-07-08T12:37:38.755Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-08T12:37:38.755Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-07-08T12:37:38.755Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-auth-e2e-api-a-c1cfd9","error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-api-a-c1cfd9\" not found"}
{"level":"info","ts":"2026-07-08T12:37:38.952Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-07-08T12:37:39.042Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-ratelimiting-e2e-api-a-c1cfd9","error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-api-a-c1cfd9\" not found"}
{"level":"error","ts":"2026-07-08T12:37:39.053Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/03552186d44455dbad37c855ef2846376bd1cf96371e6fc8cc8b47f481fd1d71","error":"authconfigs.authorino.kuadrant.io \"03552186d44455dbad37c855ef2846376bd1cf96371e6fc8cc8b47f481fd1d71\" not found"}
{"level":"error","ts":"2026-07-08T12:37:39.063Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/7c6fff72123e9a6b85e8075d0bf089992f50d3b0c14b10cec678c9abc97eb1fa","error":"authconfigs.authorino.kuadrant.io \"7c6fff72123e9a6b85e8075d0bf089992f50d3b0c14b10cec678c9abc97eb1fa\" not found"}
{"level":"error","ts":"2026-07-08T12:37:39.150Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/f909597bb51c84b04b91251130d38e6784c4a1493305573d66cd1943b3fb7095","error":"authconfigs.authorino.kuadrant.io \"f909597bb51c84b04b91251130d38e6784c4a1493305573d66cd1943b3fb7095\" not found"}
{"level":"error","ts":"2026-07-08T12:37:39.342Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/a06542bef29b2a93975e5d0166d7a9db914b2f456b5624fae0c27efe9c2490cd","error":"authconfigs.authorino.kuadrant.io \"a06542bef29b2a93975e5d0166d7a9db914b2f456b5624fae0c27efe9c2490cd\" not found"}
{"level":"error","ts":"2026-07-08T12:37:39.756Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to delete wasmplugin object","gateway":"openshift-ingress/e2e-api-a-c1cfd9","wasmplugin":"openshift-ingress/kuadrant-e2e-api-a-c1cfd9","error":"wasmplugins.extensions.istio.io \"kuadrant-e2e-api-a-c1cfd9\" not found"}
{"level":"error","ts":"2026-07-08T12:37:39.942Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-api-b-f4d1bb","namespace":"openshift-ingress","uid":"0158e1b3-b767-44b3-919c-f28492e05954","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-api-b-f4d1bb\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-08T12:37:39.943Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-api-a-c1cfd9-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-api-a-c1cfd9-maas-auth\" not found"}
{"level":"error","ts":"2026-07-08T12:37:40.067Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-api-b-f4d1bb-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-api-b-f4d1bb-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-08T12:37:40.774Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-api-a-c1cfd9","namespace":"openshift-ingress","uid":"20a87e8d-216d-4217-a7a8-fe5220c41f9a","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-api-a-c1cfd9\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-08T12:37:40.774Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"error","ts":"2026-07-08T12:37:41.043Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-api-b-f4d1bb","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-api-b-f4d1bb\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-08T12:37:41.154Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-api-a-c1cfd9","error":"gateways.gateway.networking.k8s.io \"e2e-api-a-c1cfd9\" not found"}
{"level":"info","ts":"2026-07-08T12:37:41.259Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-08T12:37:44.145Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","ConfigMap","AuthPolicy","Gateway","Limitador","EnvoyFilter","HTTPRoute","WasmPlugin","AuthConfig"],"eventTypes":{"delete":10,"update":6}}
{"level":"info","ts":"2026-07-08T12:37:44.158Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-08T12:37:44.164Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-08T12:37:44.550Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-08T12:37:44.550Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-08T12:37:44.752Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-08T12:37:44.948Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-08T12:37:44.948Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-08T12:37:45.053Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-08T12:37:45.053Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-08T12:37:45.148Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"error","ts":"2026-07-08T12:37:45.154Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-08T12:37:45.154Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-08T12:37:45.956Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"error","ts":"2026-07-08T12:37:46.044Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-api-b-f4d1bb","error":"gateways.gateway.networking.k8s.io \"e2e-api-b-f4d1bb\" not found"}
{"level":"info","ts":"2026-07-08T12:37:46.350Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-08T12:37:49.848Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","Gateway","ConfigMap","Limitador","AuthConfig","AuthPolicy","WasmPlugin","EnvoyFilter"],"eventTypes":{"create":1,"delete":9,"update":4}}
{"level":"info","ts":"2026-07-08T12:37:49.861Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-08T12:37:49.866Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-08T12:37:50.046Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-08T12:37:50.046Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-08T12:37:50.448Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-08T12:37:50.454Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-07-08T12:37:50.645Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-08T12:37:50.646Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-08T12:37:50.648Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-08T12:37:50.648Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-08T12:37:50.753Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-08T12:37:51.504Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"error","ts":"2026-07-08T12:37:51.649Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-a-b4806b","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-a-b4806b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-08T12:37:51.650Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-08T12:37:51.854Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway"],"eventTypes":{"update":1}}
{"level":"info","ts":"2026-07-08T12:37:52.344Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-08T12:37:52.442Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-08T12:37:52.442Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-08T12:37:52.450Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-07-08T12:37:52.753Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-08T12:37:52.753Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-07-08T12:37:52.846Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-08T12:37:52.846Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-07-08T12:37:53.059Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-api-b-f4d1bb","namespace":"openshift-ingress","uid":"0158e1b3-b767-44b3-919c-f28492e05954","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-api-b-f4d1bb\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-08T12:37:53.342Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"error","ts":"2026-07-08T12:37:53.643Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-a-b4806b","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-a-b4806b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-08T12:37:53.653Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-08T12:37:55.959Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","ConfigMap","Limitador","TokenRateLimitPolicy","HTTPRoute"],"eventTypes":{"create":2,"update":4}}
{"level":"info","ts":"2026-07-08T12:37:55.972Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-08T12:37:56.049Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-08T12:37:56.242Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-08T12:37:56.242Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-08T12:37:56.749Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-08T12:37:56.841Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-08T12:37:56.842Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-08T12:37:56.850Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-08T12:37:56.952Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-08T12:37:57.049Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"error","ts":"2026-07-08T12:37:57.054Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-08T12:37:57.054Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-08T12:37:57.888Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"error","ts":"2026-07-08T12:37:58.058Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-b-58b9d8","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-b-58b9d8\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-08T12:37:58.354Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-08T12:37:58.757Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway"],"eventTypes":{"create":1}}
{"level":"info","ts":"2026-07-08T12:37:59.942Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-08T12:37:59.942Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-08T12:38:00.044Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-08T12:38:00.152Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-08T12:38:00.254Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-07-08T12:38:00.351Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-shared-a-b4806b","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/ratelimit":"true"},"name":"kuadrant-ratelimiting-e2e-shared-a-b4806b","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-a-b4806b","uid":"bd51778b-9df9-4cd8-b981-877f37aaeab3"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"limitador-limitador.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-ratelimit-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"limitador-limitador.kuadrant-system.svc.cluster.local","port_value":8081}}}}]}]},"name":"kuadrant-ratelimit-service","type":"STRICT_DNS"}}}],"targetRefs":[{"group":"gateway.networking.k8s.io","kind":"Gateway","name":"e2e-shared-a-b4806b"}]},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-shared-a-b4806b\" already exists"}
{"level":"info","ts":"2026-07-08T12:38:00.445Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"error","ts":"2026-07-08T12:38:00.455Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-08T12:38:00.455Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-07-08T12:38:00.870Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to create wasmplugin object","gateway":"openshift-ingress/e2e-shared-a-b4806b","wasmplugin":{"apiVersion":"extensions.istio.io/v1alpha1","kind":"WasmPlugin","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true"},"name":"kuadrant-e2e-shared-a-b4806b","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-a-b4806b","uid":"bd51778b-9df9-4cd8-b981-877f37aaeab3"}]},"spec":{"phase":"STATS","pluginConfig":{"actionSets":[{"actions":[{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__12ba706a","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-b4806b","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-b4806b"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__12ba706a","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-b4806b","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-b4806b"]}],"name":"21e2e24fa6fe7bc7142cc1a8b51a26b881f0cd9a6fd25c38b4043190bf9030f9","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/v1/subscriptions')"]}},{"actions":[{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__12ba706a","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-b4806b","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-b4806b"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__12ba706a","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-b4806b","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-b4806b"]}],"name":"f140a2cdfc75c90dda02d3dee049015070782c67203ab357bb2040f7fd1f1d5b","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/v1/api-keys')"]}},{"actions":[{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__12ba706a","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-b4806b","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-b4806b"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__12ba706a","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-b4806b","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-b4806b"]}],"name":"77d107f79456a0f971225095ec0fdee21de74755b266877b58ed50844e5f140f","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/v1/models')"]}},{"actions":[{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__12ba706a","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-b4806b","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-b4806b"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__12ba706a","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-b4806b","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-b4806b"]}],"name":"ecdfc588bda7f2caeb9f3e31acc7c74dd74ec94304d83aaf065c66441376b0ff","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/maas-api')"]}}],"services":{"auth-service":{"endpoint":"kuadrant-auth-service","failureMode":"deny","timeout":"200ms","type":"auth"},"ratelimit-check-service":{"endpoint":"kuadrant-ratelimit-service","failureMode":"deny","timeout":"100ms","type":"ratelimit-check"},"ratelimit-report-service":{"endpoint":"kuadrant-ratelimit-service","failureMode":"deny","timeout":"100ms","type":"ratelimit-report"},"ratelimit-service":{"endpoint":"kuadrant-ratelimit-service","failureMode":"allow","timeout":"100ms","type":"ratelimit"}}},"targetRefs":[{"group":"gateway.networking.k8s.io","kind":"Gateway","name":"e2e-shared-a-b4806b"}],"url":"quay.io/kuadrant/wasm-shim:v0.12.1"},"status":{}},"error":"wasmplugins.extensions.istio.io \"kuadrant-e2e-shared-a-b4806b\" already exists"}
{"level":"error","ts":"2026-07-08T12:38:01.492Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-a-b4806b","namespace":"openshift-ingress","uid":"43b7b0dc-5942-42b4-a989-d343c8b4a820","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-a-b4806b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-08T12:38:01.492Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"error","ts":"2026-07-08T12:38:01.642Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-b-58b9d8","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-b-58b9d8\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-08T12:38:01.656Z","logger":"kuadrant-operator.HTTPRoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"maas-api-route-e2e-shared-a-b4806b","namespace":"odh-ai-gateway-infra","uid":"cc0b094e-dc1d-4cf4-bc44-744d71eccff5","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"maas-api-route-e2e-shared-a-b4806b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-08T12:38:01.749Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-a-b4806b","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-a-b4806b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-08T12:38:01.848Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-08T12:38:04.344Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Limitador","TokenRateLimitPolicy","WasmPlugin","EnvoyFilter","HTTPRoute","Gateway","ConfigMap"],"eventTypes":{"create":4,"update":6}}
{"level":"info","ts":"2026-07-08T12:38:04.359Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-08T12:38:04.364Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-08T12:38:04.647Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-08T12:38:04.647Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-08T12:38:05.146Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-08T12:38:05.153Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-08T12:38:05.347Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-07-08T12:38:05.442Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-08T12:38:05.442Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-08T12:38:05.451Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-08T12:38:05.642Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-08T12:38:06.684Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-08T12:38:07.459Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-08T12:38:10.848Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","EnvoyFilter","Gateway","Limitador","WasmPlugin","HTTPRoute","ConfigMap"],"eventTypes":{"create":2,"update":6}}
{"level":"info","ts":"2026-07-08T12:38:10.862Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-08T12:38:10.943Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-08T12:38:11.043Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-08T12:38:11.043Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-08T12:38:11.653Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-08T12:38:11.742Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-08T12:38:11.742Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-08T12:38:11.842Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-08T12:38:11.853Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-08T12:38:12.046Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-07-08T12:38:12.046Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-08T12:38:13.262Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-08T12:38:13.451Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-08T12:38:14.855Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","Limitador","TokenRateLimitPolicy"],"eventTypes":{"update":6}}
{"level":"info","ts":"2026-07-08T12:38:14.868Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-08T12:38:15.055Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-08T12:38:15.242Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-08T12:38:15.242Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-08T12:38:15.963Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-08T12:38:16.142Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-08T12:38:16.142Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-08T12:38:16.142Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-07-08T12:38:16.142Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-08T12:38:16.351Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-08T12:38:17.593Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-08T12:38:17.961Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-08T12:41:10.453Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","ConfigMap","HTTPRoute"],"eventTypes":{"delete":1,"update":2}}
{"level":"info","ts":"2026-07-08T12:41:11.152Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-08T12:41:11.241Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-08T12:41:11.242Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-08T12:41:11.341Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-08T12:41:11.349Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-07-08T12:41:11.650Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-08T12:41:11.650Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-08T12:41:12.293Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-08T12:41:12.747Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-08T12:41:16.343Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","Limitador","ConfigMap","EnvoyFilter","WasmPlugin"],"eventTypes":{"delete":2,"update":6}}
{"level":"info","ts":"2026-07-08T12:41:16.359Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-08T12:41:16.365Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-08T12:41:16.643Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-08T12:41:16.643Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-08T12:41:16.844Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-08T12:41:16.854Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-07-08T12:41:16.854Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-08T12:41:17.050Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-08T12:41:17.050Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-08T12:41:17.147Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-08T12:41:17.977Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"error","ts":"2026-07-08T12:41:18.149Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-b-58b9d8","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-b-58b9d8\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-08T12:41:18.157Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-08T12:41:18.453Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway"],"eventTypes":{"delete":1}}
{"level":"info","ts":"2026-07-08T12:41:19.141Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-08T12:41:19.144Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-08T12:41:19.148Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-07-08T12:41:19.148Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-08T12:41:19.149Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-08T12:41:19.149Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-08T12:41:19.252Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-07-08T12:41:19.988Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-b-58b9d8","namespace":"openshift-ingress","uid":"b69dccbe-f4ad-4433-b6c3-b91e5edd7e69","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-b-58b9d8\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-08T12:41:19.992Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-a-b4806b","namespace":"openshift-ingress","uid":"43b7b0dc-5942-42b4-a989-d343c8b4a820","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-a-b4806b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-08T12:41:20.149Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-facebook-opt-125m-simulated","namespace":"llm","uid":"0667fa6a-f240-4a1e-a116-6b8aa1c9ba93","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-facebook-opt-125m-simulated\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-08T12:41:20.350Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-simulated-simulated-premium","namespace":"llm","uid":"0893bbf0-dbce-4292-8594-200dc25cb63a","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-simulated-simulated-premium\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-08T12:41:20.369Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"error","ts":"2026-07-08T12:41:20.549Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-b-58b9d8","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-b-58b9d8\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-08T12:41:20.550Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-08T12:41:23.846Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","ConfigMap","Limitador","Gateway","HTTPRoute"],"eventTypes":{"delete":1,"update":7}}
{"level":"info","ts":"2026-07-08T12:41:23.860Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-08T12:41:23.865Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-08T12:41:24.042Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-08T12:41:24.042Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-08T12:41:24.448Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-08T12:41:24.544Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-08T12:41:24.544Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-08T12:41:24.646Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-08T12:41:24.754Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-08T12:41:24.845Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-07-08T12:41:24.856Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-08T12:41:25.595Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-08T12:41:25.742Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-08T12:41:25.843Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","EnvoyFilter","WasmPlugin"],"eventTypes":{"delete":3}}
{"level":"info","ts":"2026-07-08T12:41:26.450Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-08T12:41:26.541Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-08T12:41:26.542Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-08T12:41:26.550Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-08T12:41:26.651Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-08T12:41:26.745Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"error","ts":"2026-07-08T12:41:26.751Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-08T12:41:26.751Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-07-08T12:41:27.303Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-simulated-simulated-premium","namespace":"llm","uid":"0893bbf0-dbce-4292-8594-200dc25cb63a","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-simulated-simulated-premium\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-08T12:41:27.319Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-b-58b9d8","namespace":"openshift-ingress","uid":"b69dccbe-f4ad-4433-b6c3-b91e5edd7e69","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-b-58b9d8\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-08T12:41:27.352Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-facebook-opt-125m-simulated","namespace":"llm","uid":"0667fa6a-f240-4a1e-a116-6b8aa1c9ba93","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-facebook-opt-125m-simulated\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-08T12:41:27.372Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-08T12:41:27.551Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-08T12:41:29.947Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","TokenRateLimitPolicy","Limitador"],"eventTypes":{"update":5}}
{"level":"info","ts":"2026-07-08T12:41:29.960Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}