{"level":"debug","ts":"2026-07-14T14:38:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"971824d4c761c1f804e7d36b3c0330e565476ba6494a980c11ac326ac06fb364","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-14T14:38:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/73e69c2455ce4b899cd25e18692117bb537a9e9a263492536ea7472aa5fdaa91"}
{"level":"debug","ts":"2026-07-14T14:38:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"875e872ba3c852be3df6294ca1aab4844f2bfa0fa12420654a36470557312af7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T14:38:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1e03efe38798796711abc864778b01055ffda75d62ad02e539b4d8de49181043","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-14T14:38:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/094510494d7caf433920f29a0330acf598fa452f709feed986324ed6e890a53c"}
{"level":"debug","ts":"2026-07-14T14:38:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2cb15ddc2b3fc6c7229894a41fc72a84c27c3b1ca44fffa81999c75f7ec6df22","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-14T14:38:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/971824d4c761c1f804e7d36b3c0330e565476ba6494a980c11ac326ac06fb364"}
{"level":"debug","ts":"2026-07-14T14:38:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8c9ad5ee101909de2adc676bba26ae67775d5e9e7127e3269fe79d03a807fd5b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-14T14:38:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/875e872ba3c852be3df6294ca1aab4844f2bfa0fa12420654a36470557312af7"}
{"level":"debug","ts":"2026-07-14T14:38:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b5d08e5139f05f6d4b25a9b21ae064aec2f09faa39df56fb27bdae83a7eab912","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-14T14:38:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1e03efe38798796711abc864778b01055ffda75d62ad02e539b4d8de49181043"}
{"level":"debug","ts":"2026-07-14T14:38:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ca5c3e93e7ad2e57d078282c6991a368fc2db7efbcfcac6f212ff88b9dbb689c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-14T14:38:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2cb15ddc2b3fc6c7229894a41fc72a84c27c3b1ca44fffa81999c75f7ec6df22"}
{"level":"debug","ts":"2026-07-14T14:38:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"325fd5a45bf0c37746cc0bfb6580db2576ee085318bcb3171807f975c1cfadc5","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-14T14:38:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8c9ad5ee101909de2adc676bba26ae67775d5e9e7127e3269fe79d03a807fd5b"}
{"level":"debug","ts":"2026-07-14T14:38:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d5e6ad9d490dcd8e3b4714a7c9829a582e9edb0797cea46a0185730a61c91926","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T14:38:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cd1a96843ac3d23be05a951e39360eb168c2ecf8f8b1a03e23fa8a299bc64354","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-14T14:38:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b5d08e5139f05f6d4b25a9b21ae064aec2f09faa39df56fb27bdae83a7eab912"}
{"level":"debug","ts":"2026-07-14T14:38:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e0e6d7236e0be3a42992259f0a03f2dd6321f54f718ed5c6f098001470a55a97","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-14T14:38:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ca5c3e93e7ad2e57d078282c6991a368fc2db7efbcfcac6f212ff88b9dbb689c"}
{"level":"debug","ts":"2026-07-14T14:38:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"97d8a986a1f36d2c9d70faf8c55b45141fe691f273f965b26dd7a504a75780e9","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-14T14:38:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/325fd5a45bf0c37746cc0bfb6580db2576ee085318bcb3171807f975c1cfadc5"}
{"level":"debug","ts":"2026-07-14T14:38:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"69e78be2d9d1ab531b397f50660ffb24b1f2f801b09b2a395900d6ad33c93637","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-14T14:38:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d5e6ad9d490dcd8e3b4714a7c9829a582e9edb0797cea46a0185730a61c91926"}
{"level":"info","ts":"2026-07-14T14:38:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cd1a96843ac3d23be05a951e39360eb168c2ecf8f8b1a03e23fa8a299bc64354"}
{"level":"info","ts":"2026-07-14T14:38:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e0e6d7236e0be3a42992259f0a03f2dd6321f54f718ed5c6f098001470a55a97"}
{"level":"info","ts":"2026-07-14T14:38:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/97d8a986a1f36d2c9d70faf8c55b45141fe691f273f965b26dd7a504a75780e9"}
{"level":"info","ts":"2026-07-14T14:38:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/69e78be2d9d1ab531b397f50660ffb24b1f2f801b09b2a395900d6ad33c93637"}
{"level":"info","ts":"2026-07-14T14:38:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9e51cc8c-e49e-47d7-b0f7-be7cfed27e60","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:34724","PortSpecifier":{"PortValue":34724}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9e51cc8c-e49e-47d7-b0f7-be7cfed27e60","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-8442f2.apps.dd9d6126-2103-4067-bfcb-65a9b54ce21c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-14T14:38:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9e51cc8c-e49e-47d7-b0f7-be7cfed27e60","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:34724","PortSpecifier":{"PortValue":34724}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784039911,"nanos":747208530},"http":{"id":"9e51cc8c-e49e-47d7-b0f7-be7cfed27e60","method":"POST","headers":{":authority":"e2e-shared-a-8442f2.apps.dd9d6126-2103-4067-bfcb-65a9b54ce21c.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T14:38:31Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"9e51cc8c-e49e-47d7-b0f7-be7cfed27e60","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-14T14:38:31Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9e51cc8c-e49e-47d7-b0f7-be7cfed27e60","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"f61b082d-dfd5-43f3-989e-d05902e01343","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=f60cccb0-6c6b-4590-924d-57d22aafc60c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/65a9b54ce21c"]}}
{"level":"debug","ts":"2026-07-14T14:38:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9e51cc8c-e49e-47d7-b0f7-be7cfed27e60","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/65a9b54ce21c"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=f60cccb0-6c6b-4590-924d-57d22aafc60c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"f61b082d-dfd5-43f3-989e-d05902e01343","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"bbdbd5aa1b919985e447ece3303413dc26151acf3f244b3462b6ea862b3d3968"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.57:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-8442f2.apps.dd9d6126-2103-4067-bfcb-65a9b54ce21c.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T14:38:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9e51cc8c-e49e-47d7-b0f7-be7cfed27e60","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:38:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9e51cc8c-e49e-47d7-b0f7-be7cfed27e60","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:38:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9e51cc8c-e49e-47d7-b0f7-be7cfed27e60","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-8442f2/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:38:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"9e51cc8c-e49e-47d7-b0f7-be7cfed27e60","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-14T14:38:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9e51cc8c-e49e-47d7-b0f7-be7cfed27e60","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-14T14:38:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9e51cc8c-e49e-47d7-b0f7-be7cfed27e60","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-14T14:38:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9e51cc8c-e49e-47d7-b0f7-be7cfed27e60","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-14T14:38:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9e51cc8c-e49e-47d7-b0f7-be7cfed27e60","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-14T14:38:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a5028076-2964-4093-abd0-ffc0aacc8443","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:44528","PortSpecifier":{"PortValue":44528}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a5028076-2964-4093-abd0-ffc0aacc8443","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-f8f81e.apps.dd9d6126-2103-4067-bfcb-65a9b54ce21c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-14T14:38:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a5028076-2964-4093-abd0-ffc0aacc8443","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:44528","PortSpecifier":{"PortValue":44528}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784039911,"nanos":801579688},"http":{"id":"a5028076-2964-4093-abd0-ffc0aacc8443","method":"POST","headers":{":authority":"e2e-shared-b-f8f81e.apps.dd9d6126-2103-4067-bfcb-65a9b54ce21c.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T14:38:31Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"a5028076-2964-4093-abd0-ffc0aacc8443","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-14T14:38:31Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a5028076-2964-4093-abd0-ffc0aacc8443","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"f61b082d-dfd5-43f3-989e-d05902e01343","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=f60cccb0-6c6b-4590-924d-57d22aafc60c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/65a9b54ce21c"]}}
{"level":"debug","ts":"2026-07-14T14:38:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a5028076-2964-4093-abd0-ffc0aacc8443","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/65a9b54ce21c"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=f60cccb0-6c6b-4590-924d-57d22aafc60c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"f61b082d-dfd5-43f3-989e-d05902e01343","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"95f215820b0caa307c8e4aa64730562f3168e38c696151615873203a0390d66a"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.58:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-f8f81e.apps.dd9d6126-2103-4067-bfcb-65a9b54ce21c.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T14:38:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a5028076-2964-4093-abd0-ffc0aacc8443","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:38:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a5028076-2964-4093-abd0-ffc0aacc8443","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:38:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a5028076-2964-4093-abd0-ffc0aacc8443","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-f8f81e/rate-test-model-f8f81e\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-f8f81e/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:38:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"a5028076-2964-4093-abd0-ffc0aacc8443","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-14T14:38:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a5028076-2964-4093-abd0-ffc0aacc8443","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-14T14:38:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a5028076-2964-4093-abd0-ffc0aacc8443","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-14T14:38:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a5028076-2964-4093-abd0-ffc0aacc8443","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-14T14:38:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a5028076-2964-4093-abd0-ffc0aacc8443","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-14T14:38:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"54b30949-1efc-4d09-babe-8f52d420bc4c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:34728","PortSpecifier":{"PortValue":34728}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"54b30949-1efc-4d09-babe-8f52d420bc4c","method":"POST","path":"/ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2/v1/completions","host":"e2e-shared-a-8442f2.apps.dd9d6126-2103-4067-bfcb-65a9b54ce21c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-14T14:38:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"54b30949-1efc-4d09-babe-8f52d420bc4c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:34728","PortSpecifier":{"PortValue":34728}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784039911,"nanos":864748853},"http":{"id":"54b30949-1efc-4d09-babe-8f52d420bc4c","method":"POST","headers":{":authority":"e2e-shared-a-8442f2.apps.dd9d6126-2103-4067-bfcb-65a9b54ce21c.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T14:38:31Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"54b30949-1efc-4d09-babe-8f52d420bc4c","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-8oalYCYCPIrxXOzj_FFq3URWJcpuFjG7ncJUiIZNRJE9zXBszJlDVBttx3h7"}
{"level":"debug","ts":"2026-07-14T14:38:31Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"54b30949-1efc-4d09-babe-8f52d420bc4c","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-8442f2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-8oalYCYCPIrxXOzj_FFq3URWJcpuFjG7ncJUiIZNRJE9zXBszJlDVBttx3h7\"}"}
{"level":"debug","ts":"2026-07-14T14:38:31Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"54b30949-1efc-4d09-babe-8f52d420bc4c","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-8442f2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"d7a19557-38c0-4402-a839-a95a41d1536f","keyName":"e2e-rate-a-152792","subscription":"e2e-rate-iso-a-152792","tenant":"e2e-shared-a-8442f2","userId":"d7a19557-38c0-4402-a839-a95a41d1536f","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-14T14:38:31Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"54b30949-1efc-4d09-babe-8f52d420bc4c","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-8442f2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2\",\"requestedSubscription\":\"e2e-rate-iso-a-152792\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-14T14:38:31Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"54b30949-1efc-4d09-babe-8f52d420bc4c","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-8442f2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-8442f2","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-152792","namespace":"ai-tenant-e2e-shared-a-8442f2","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-14T14:38:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"54b30949-1efc-4d09-babe-8f52d420bc4c","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T14:38:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"54b30949-1efc-4d09-babe-8f52d420bc4c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:38:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"54b30949-1efc-4d09-babe-8f52d420bc4c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:38:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"54b30949-1efc-4d09-babe-8f52d420bc4c","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:38:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"54b30949-1efc-4d09-babe-8f52d420bc4c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-8442f2/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:38:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"54b30949-1efc-4d09-babe-8f52d420bc4c","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-14T14:38:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"54b30949-1efc-4d09-babe-8f52d420bc4c","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-152792"}
{"level":"debug","ts":"2026-07-14T14:38:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"54b30949-1efc-4d09-babe-8f52d420bc4c","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-14T14:38:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"54b30949-1efc-4d09-babe-8f52d420bc4c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"d7a19557-38c0-4402-a839-a95a41d1536f","keyName":"e2e-rate-a-152792","selected_subscription":"e2e-rate-iso-a-152792","selected_subscription_key":"ai-tenant-e2e-shared-a-8442f2/e2e-rate-iso-a-152792@ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-8442f2","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-152792","namespace":"ai-tenant-e2e-shared-a-8442f2","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-14T14:38:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"54b30949-1efc-4d09-babe-8f52d420bc4c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-14T14:38:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"54b30949-1efc-4d09-babe-8f52d420bc4c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-14T14:38:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3fd010dc-3581-41a9-b616-e1dea5f6826d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:34744","PortSpecifier":{"PortValue":34744}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3fd010dc-3581-41a9-b616-e1dea5f6826d","method":"POST","path":"/ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2/v1/completions","host":"e2e-shared-a-8442f2.apps.dd9d6126-2103-4067-bfcb-65a9b54ce21c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-14T14:38:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3fd010dc-3581-41a9-b616-e1dea5f6826d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:34744","PortSpecifier":{"PortValue":34744}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784039912,"nanos":924528728},"http":{"id":"3fd010dc-3581-41a9-b616-e1dea5f6826d","method":"POST","headers":{":authority":"e2e-shared-a-8442f2.apps.dd9d6126-2103-4067-bfcb-65a9b54ce21c.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T14:38:32Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3fd010dc-3581-41a9-b616-e1dea5f6826d","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-8oalYCYCPIrxXOzj_FFq3URWJcpuFjG7ncJUiIZNRJE9zXBszJlDVBttx3h7"}
{"level":"debug","ts":"2026-07-14T14:38:32Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3fd010dc-3581-41a9-b616-e1dea5f6826d","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-8442f2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-8oalYCYCPIrxXOzj_FFq3URWJcpuFjG7ncJUiIZNRJE9zXBszJlDVBttx3h7\"}"}
{"level":"debug","ts":"2026-07-14T14:38:32Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3fd010dc-3581-41a9-b616-e1dea5f6826d","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-8442f2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"d7a19557-38c0-4402-a839-a95a41d1536f","keyName":"e2e-rate-a-152792","subscription":"e2e-rate-iso-a-152792","tenant":"e2e-shared-a-8442f2","userId":"d7a19557-38c0-4402-a839-a95a41d1536f","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-14T14:38:32Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3fd010dc-3581-41a9-b616-e1dea5f6826d","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-8442f2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2\",\"requestedSubscription\":\"e2e-rate-iso-a-152792\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-14T14:38:32Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3fd010dc-3581-41a9-b616-e1dea5f6826d","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-8442f2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-8442f2","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-152792","namespace":"ai-tenant-e2e-shared-a-8442f2","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-14T14:38:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3fd010dc-3581-41a9-b616-e1dea5f6826d","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T14:38:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3fd010dc-3581-41a9-b616-e1dea5f6826d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:38:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3fd010dc-3581-41a9-b616-e1dea5f6826d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:38:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3fd010dc-3581-41a9-b616-e1dea5f6826d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-8442f2/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:38:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3fd010dc-3581-41a9-b616-e1dea5f6826d","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:38:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3fd010dc-3581-41a9-b616-e1dea5f6826d","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-14T14:38:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3fd010dc-3581-41a9-b616-e1dea5f6826d","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-14T14:38:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3fd010dc-3581-41a9-b616-e1dea5f6826d","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-152792"}
{"level":"debug","ts":"2026-07-14T14:38:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3fd010dc-3581-41a9-b616-e1dea5f6826d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"d7a19557-38c0-4402-a839-a95a41d1536f","keyName":"e2e-rate-a-152792","selected_subscription":"e2e-rate-iso-a-152792","selected_subscription_key":"ai-tenant-e2e-shared-a-8442f2/e2e-rate-iso-a-152792@ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-8442f2","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-152792","namespace":"ai-tenant-e2e-shared-a-8442f2","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-14T14:38:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3fd010dc-3581-41a9-b616-e1dea5f6826d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-14T14:38:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3fd010dc-3581-41a9-b616-e1dea5f6826d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-14T14:38:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"06436183-3ed5-49ae-8a77-6c982efe6d87","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:34752","PortSpecifier":{"PortValue":34752}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"06436183-3ed5-49ae-8a77-6c982efe6d87","method":"POST","path":"/ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2/v1/completions","host":"e2e-shared-a-8442f2.apps.dd9d6126-2103-4067-bfcb-65a9b54ce21c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-14T14:38:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"06436183-3ed5-49ae-8a77-6c982efe6d87","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:34752","PortSpecifier":{"PortValue":34752}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784039913,"nanos":963605354},"http":{"id":"06436183-3ed5-49ae-8a77-6c982efe6d87","method":"POST","headers":{":authority":"e2e-shared-a-8442f2.apps.dd9d6126-2103-4067-bfcb-65a9b54ce21c.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T14:38:33Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"06436183-3ed5-49ae-8a77-6c982efe6d87","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-8oalYCYCPIrxXOzj_FFq3URWJcpuFjG7ncJUiIZNRJE9zXBszJlDVBttx3h7"}
{"level":"debug","ts":"2026-07-14T14:38:33Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"06436183-3ed5-49ae-8a77-6c982efe6d87","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-8442f2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-8oalYCYCPIrxXOzj_FFq3URWJcpuFjG7ncJUiIZNRJE9zXBszJlDVBttx3h7\"}"}
{"level":"debug","ts":"2026-07-14T14:38:33Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"06436183-3ed5-49ae-8a77-6c982efe6d87","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-8442f2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"d7a19557-38c0-4402-a839-a95a41d1536f","keyName":"e2e-rate-a-152792","subscription":"e2e-rate-iso-a-152792","tenant":"e2e-shared-a-8442f2","userId":"d7a19557-38c0-4402-a839-a95a41d1536f","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-14T14:38:33Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"06436183-3ed5-49ae-8a77-6c982efe6d87","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-8442f2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2\",\"requestedSubscription\":\"e2e-rate-iso-a-152792\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-14T14:38:33Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"06436183-3ed5-49ae-8a77-6c982efe6d87","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-8442f2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-8442f2","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-152792","namespace":"ai-tenant-e2e-shared-a-8442f2","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-14T14:38:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"06436183-3ed5-49ae-8a77-6c982efe6d87","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T14:38:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"06436183-3ed5-49ae-8a77-6c982efe6d87","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:38:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"06436183-3ed5-49ae-8a77-6c982efe6d87","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:38:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"06436183-3ed5-49ae-8a77-6c982efe6d87","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-8442f2/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:38:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"06436183-3ed5-49ae-8a77-6c982efe6d87","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:38:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"06436183-3ed5-49ae-8a77-6c982efe6d87","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-152792"}
{"level":"debug","ts":"2026-07-14T14:38:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"06436183-3ed5-49ae-8a77-6c982efe6d87","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-14T14:38:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"06436183-3ed5-49ae-8a77-6c982efe6d87","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-14T14:38:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"06436183-3ed5-49ae-8a77-6c982efe6d87","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"d7a19557-38c0-4402-a839-a95a41d1536f","keyName":"e2e-rate-a-152792","selected_subscription":"e2e-rate-iso-a-152792","selected_subscription_key":"ai-tenant-e2e-shared-a-8442f2/e2e-rate-iso-a-152792@ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-8442f2","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-152792","namespace":"ai-tenant-e2e-shared-a-8442f2","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-14T14:38:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"06436183-3ed5-49ae-8a77-6c982efe6d87","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-14T14:38:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"06436183-3ed5-49ae-8a77-6c982efe6d87","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-14T14:38:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f0b29319-d87e-45cf-99fe-73b2c1030603","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:34768","PortSpecifier":{"PortValue":34768}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f0b29319-d87e-45cf-99fe-73b2c1030603","method":"POST","path":"/ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2/v1/completions","host":"e2e-shared-a-8442f2.apps.dd9d6126-2103-4067-bfcb-65a9b54ce21c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-14T14:38:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f0b29319-d87e-45cf-99fe-73b2c1030603","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:34768","PortSpecifier":{"PortValue":34768}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784039915,"nanos":491181},"http":{"id":"f0b29319-d87e-45cf-99fe-73b2c1030603","method":"POST","headers":{":authority":"e2e-shared-a-8442f2.apps.dd9d6126-2103-4067-bfcb-65a9b54ce21c.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T14:38:35Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f0b29319-d87e-45cf-99fe-73b2c1030603","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-8oalYCYCPIrxXOzj_FFq3URWJcpuFjG7ncJUiIZNRJE9zXBszJlDVBttx3h7"}
{"level":"debug","ts":"2026-07-14T14:38:35Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f0b29319-d87e-45cf-99fe-73b2c1030603","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-8442f2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-8oalYCYCPIrxXOzj_FFq3URWJcpuFjG7ncJUiIZNRJE9zXBszJlDVBttx3h7\"}"}
{"level":"debug","ts":"2026-07-14T14:38:35Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f0b29319-d87e-45cf-99fe-73b2c1030603","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-8442f2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"d7a19557-38c0-4402-a839-a95a41d1536f","keyName":"e2e-rate-a-152792","subscription":"e2e-rate-iso-a-152792","tenant":"e2e-shared-a-8442f2","userId":"d7a19557-38c0-4402-a839-a95a41d1536f","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-14T14:38:35Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f0b29319-d87e-45cf-99fe-73b2c1030603","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-8442f2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2\",\"requestedSubscription\":\"e2e-rate-iso-a-152792\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-14T14:38:35Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f0b29319-d87e-45cf-99fe-73b2c1030603","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-8442f2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-8442f2","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-152792","namespace":"ai-tenant-e2e-shared-a-8442f2","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-14T14:38:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f0b29319-d87e-45cf-99fe-73b2c1030603","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T14:38:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f0b29319-d87e-45cf-99fe-73b2c1030603","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:38:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f0b29319-d87e-45cf-99fe-73b2c1030603","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:38:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f0b29319-d87e-45cf-99fe-73b2c1030603","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-8442f2/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:38:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f0b29319-d87e-45cf-99fe-73b2c1030603","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:38:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f0b29319-d87e-45cf-99fe-73b2c1030603","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-14T14:38:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f0b29319-d87e-45cf-99fe-73b2c1030603","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-14T14:38:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f0b29319-d87e-45cf-99fe-73b2c1030603","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-152792"}
{"level":"debug","ts":"2026-07-14T14:38:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f0b29319-d87e-45cf-99fe-73b2c1030603","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"d7a19557-38c0-4402-a839-a95a41d1536f","keyName":"e2e-rate-a-152792","selected_subscription":"e2e-rate-iso-a-152792","selected_subscription_key":"ai-tenant-e2e-shared-a-8442f2/e2e-rate-iso-a-152792@ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-8442f2","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-152792","namespace":"ai-tenant-e2e-shared-a-8442f2","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-14T14:38:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f0b29319-d87e-45cf-99fe-73b2c1030603","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-14T14:38:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f0b29319-d87e-45cf-99fe-73b2c1030603","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-14T14:38:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"86916872-07fe-46d7-b556-92b3d74466b3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:34784","PortSpecifier":{"PortValue":34784}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"86916872-07fe-46d7-b556-92b3d74466b3","method":"POST","path":"/ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2/v1/completions","host":"e2e-shared-a-8442f2.apps.dd9d6126-2103-4067-bfcb-65a9b54ce21c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-14T14:38:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"86916872-07fe-46d7-b556-92b3d74466b3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:34784","PortSpecifier":{"PortValue":34784}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784039916,"nanos":40852529},"http":{"id":"86916872-07fe-46d7-b556-92b3d74466b3","method":"POST","headers":{":authority":"e2e-shared-a-8442f2.apps.dd9d6126-2103-4067-bfcb-65a9b54ce21c.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T14:38:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"86916872-07fe-46d7-b556-92b3d74466b3","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-8oalYCYCPIrxXOzj_FFq3URWJcpuFjG7ncJUiIZNRJE9zXBszJlDVBttx3h7"}
{"level":"debug","ts":"2026-07-14T14:38:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"86916872-07fe-46d7-b556-92b3d74466b3","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-8442f2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-8oalYCYCPIrxXOzj_FFq3URWJcpuFjG7ncJUiIZNRJE9zXBszJlDVBttx3h7\"}"}
{"level":"debug","ts":"2026-07-14T14:38:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"86916872-07fe-46d7-b556-92b3d74466b3","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-8442f2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"d7a19557-38c0-4402-a839-a95a41d1536f","keyName":"e2e-rate-a-152792","subscription":"e2e-rate-iso-a-152792","tenant":"e2e-shared-a-8442f2","userId":"d7a19557-38c0-4402-a839-a95a41d1536f","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-14T14:38:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"86916872-07fe-46d7-b556-92b3d74466b3","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-8442f2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2\",\"requestedSubscription\":\"e2e-rate-iso-a-152792\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-14T14:38:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"86916872-07fe-46d7-b556-92b3d74466b3","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-8442f2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-8442f2","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-152792","namespace":"ai-tenant-e2e-shared-a-8442f2","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-14T14:38:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"86916872-07fe-46d7-b556-92b3d74466b3","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T14:38:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"86916872-07fe-46d7-b556-92b3d74466b3","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:38:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"86916872-07fe-46d7-b556-92b3d74466b3","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:38:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"86916872-07fe-46d7-b556-92b3d74466b3","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-8442f2/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:38:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"86916872-07fe-46d7-b556-92b3d74466b3","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:38:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"86916872-07fe-46d7-b556-92b3d74466b3","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-14T14:38:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"86916872-07fe-46d7-b556-92b3d74466b3","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-152792"}
{"level":"debug","ts":"2026-07-14T14:38:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"86916872-07fe-46d7-b556-92b3d74466b3","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-14T14:38:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"86916872-07fe-46d7-b556-92b3d74466b3","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"d7a19557-38c0-4402-a839-a95a41d1536f","keyName":"e2e-rate-a-152792","selected_subscription":"e2e-rate-iso-a-152792","selected_subscription_key":"ai-tenant-e2e-shared-a-8442f2/e2e-rate-iso-a-152792@ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-8442f2","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-152792","namespace":"ai-tenant-e2e-shared-a-8442f2","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-14T14:38:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"86916872-07fe-46d7-b556-92b3d74466b3","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-14T14:38:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"86916872-07fe-46d7-b556-92b3d74466b3","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-14T14:38:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f7952758-961d-4f9e-a1c6-51d9b1277057","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:34786","PortSpecifier":{"PortValue":34786}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f7952758-961d-4f9e-a1c6-51d9b1277057","method":"POST","path":"/ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2/v1/completions","host":"e2e-shared-a-8442f2.apps.dd9d6126-2103-4067-bfcb-65a9b54ce21c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-14T14:38:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f7952758-961d-4f9e-a1c6-51d9b1277057","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:34786","PortSpecifier":{"PortValue":34786}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784039917,"nanos":80748131},"http":{"id":"f7952758-961d-4f9e-a1c6-51d9b1277057","method":"POST","headers":{":authority":"e2e-shared-a-8442f2.apps.dd9d6126-2103-4067-bfcb-65a9b54ce21c.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T14:38:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f7952758-961d-4f9e-a1c6-51d9b1277057","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-8oalYCYCPIrxXOzj_FFq3URWJcpuFjG7ncJUiIZNRJE9zXBszJlDVBttx3h7"}
{"level":"debug","ts":"2026-07-14T14:38:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f7952758-961d-4f9e-a1c6-51d9b1277057","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-8442f2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-8oalYCYCPIrxXOzj_FFq3URWJcpuFjG7ncJUiIZNRJE9zXBszJlDVBttx3h7\"}"}
{"level":"debug","ts":"2026-07-14T14:38:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f7952758-961d-4f9e-a1c6-51d9b1277057","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-8442f2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"d7a19557-38c0-4402-a839-a95a41d1536f","keyName":"e2e-rate-a-152792","subscription":"e2e-rate-iso-a-152792","tenant":"e2e-shared-a-8442f2","userId":"d7a19557-38c0-4402-a839-a95a41d1536f","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-14T14:38:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f7952758-961d-4f9e-a1c6-51d9b1277057","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-8442f2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2\",\"requestedSubscription\":\"e2e-rate-iso-a-152792\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-14T14:38:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f7952758-961d-4f9e-a1c6-51d9b1277057","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-8442f2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-8442f2","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-152792","namespace":"ai-tenant-e2e-shared-a-8442f2","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-14T14:38:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f7952758-961d-4f9e-a1c6-51d9b1277057","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T14:38:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f7952758-961d-4f9e-a1c6-51d9b1277057","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:38:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f7952758-961d-4f9e-a1c6-51d9b1277057","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:38:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f7952758-961d-4f9e-a1c6-51d9b1277057","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:38:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f7952758-961d-4f9e-a1c6-51d9b1277057","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-8442f2/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:38:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f7952758-961d-4f9e-a1c6-51d9b1277057","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-152792"}
{"level":"debug","ts":"2026-07-14T14:38:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f7952758-961d-4f9e-a1c6-51d9b1277057","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-14T14:38:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f7952758-961d-4f9e-a1c6-51d9b1277057","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-14T14:38:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f7952758-961d-4f9e-a1c6-51d9b1277057","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"d7a19557-38c0-4402-a839-a95a41d1536f","keyName":"e2e-rate-a-152792","selected_subscription":"e2e-rate-iso-a-152792","selected_subscription_key":"ai-tenant-e2e-shared-a-8442f2/e2e-rate-iso-a-152792@ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-8442f2","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-152792","namespace":"ai-tenant-e2e-shared-a-8442f2","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-14T14:38:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f7952758-961d-4f9e-a1c6-51d9b1277057","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-14T14:38:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f7952758-961d-4f9e-a1c6-51d9b1277057","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-14T14:38:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9e246052-86aa-4ba3-aaad-490949ce32ca","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:34802","PortSpecifier":{"PortValue":34802}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9e246052-86aa-4ba3-aaad-490949ce32ca","method":"POST","path":"/ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2/v1/completions","host":"e2e-shared-a-8442f2.apps.dd9d6126-2103-4067-bfcb-65a9b54ce21c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-14T14:38:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9e246052-86aa-4ba3-aaad-490949ce32ca","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:34802","PortSpecifier":{"PortValue":34802}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784039918,"nanos":118456599},"http":{"id":"9e246052-86aa-4ba3-aaad-490949ce32ca","method":"POST","headers":{":authority":"e2e-shared-a-8442f2.apps.dd9d6126-2103-4067-bfcb-65a9b54ce21c.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T14:38:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9e246052-86aa-4ba3-aaad-490949ce32ca","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-8oalYCYCPIrxXOzj_FFq3URWJcpuFjG7ncJUiIZNRJE9zXBszJlDVBttx3h7"}
{"level":"debug","ts":"2026-07-14T14:38:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9e246052-86aa-4ba3-aaad-490949ce32ca","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-8442f2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-8oalYCYCPIrxXOzj_FFq3URWJcpuFjG7ncJUiIZNRJE9zXBszJlDVBttx3h7\"}"}
{"level":"debug","ts":"2026-07-14T14:38:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9e246052-86aa-4ba3-aaad-490949ce32ca","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-8442f2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"d7a19557-38c0-4402-a839-a95a41d1536f","keyName":"e2e-rate-a-152792","subscription":"e2e-rate-iso-a-152792","tenant":"e2e-shared-a-8442f2","userId":"d7a19557-38c0-4402-a839-a95a41d1536f","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-14T14:38:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9e246052-86aa-4ba3-aaad-490949ce32ca","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-8442f2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2\",\"requestedSubscription\":\"e2e-rate-iso-a-152792\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-14T14:38:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9e246052-86aa-4ba3-aaad-490949ce32ca","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-8442f2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-8442f2","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-152792","namespace":"ai-tenant-e2e-shared-a-8442f2","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-14T14:38:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9e246052-86aa-4ba3-aaad-490949ce32ca","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T14:38:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9e246052-86aa-4ba3-aaad-490949ce32ca","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:38:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9e246052-86aa-4ba3-aaad-490949ce32ca","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:38:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9e246052-86aa-4ba3-aaad-490949ce32ca","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-8442f2/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:38:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9e246052-86aa-4ba3-aaad-490949ce32ca","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:38:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9e246052-86aa-4ba3-aaad-490949ce32ca","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-14T14:38:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9e246052-86aa-4ba3-aaad-490949ce32ca","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-152792"}
{"level":"debug","ts":"2026-07-14T14:38:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9e246052-86aa-4ba3-aaad-490949ce32ca","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-14T14:38:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9e246052-86aa-4ba3-aaad-490949ce32ca","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"d7a19557-38c0-4402-a839-a95a41d1536f","keyName":"e2e-rate-a-152792","selected_subscription":"e2e-rate-iso-a-152792","selected_subscription_key":"ai-tenant-e2e-shared-a-8442f2/e2e-rate-iso-a-152792@ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-8442f2","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-152792","namespace":"ai-tenant-e2e-shared-a-8442f2","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-14T14:38:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9e246052-86aa-4ba3-aaad-490949ce32ca","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-14T14:38:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9e246052-86aa-4ba3-aaad-490949ce32ca","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-14T14:38:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0cfccb7e-997f-4543-b178-22d3041ce26a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:34812","PortSpecifier":{"PortValue":34812}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0cfccb7e-997f-4543-b178-22d3041ce26a","method":"POST","path":"/ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2/v1/completions","host":"e2e-shared-a-8442f2.apps.dd9d6126-2103-4067-bfcb-65a9b54ce21c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-14T14:38:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0cfccb7e-997f-4543-b178-22d3041ce26a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:34812","PortSpecifier":{"PortValue":34812}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784039919,"nanos":160423989},"http":{"id":"0cfccb7e-997f-4543-b178-22d3041ce26a","method":"POST","headers":{":authority":"e2e-shared-a-8442f2.apps.dd9d6126-2103-4067-bfcb-65a9b54ce21c.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T14:38:39Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0cfccb7e-997f-4543-b178-22d3041ce26a","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-8oalYCYCPIrxXOzj_FFq3URWJcpuFjG7ncJUiIZNRJE9zXBszJlDVBttx3h7"}
{"level":"debug","ts":"2026-07-14T14:38:39Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0cfccb7e-997f-4543-b178-22d3041ce26a","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-8442f2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-8oalYCYCPIrxXOzj_FFq3URWJcpuFjG7ncJUiIZNRJE9zXBszJlDVBttx3h7\"}"}
{"level":"debug","ts":"2026-07-14T14:38:39Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0cfccb7e-997f-4543-b178-22d3041ce26a","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-8442f2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"d7a19557-38c0-4402-a839-a95a41d1536f","keyName":"e2e-rate-a-152792","subscription":"e2e-rate-iso-a-152792","tenant":"e2e-shared-a-8442f2","userId":"d7a19557-38c0-4402-a839-a95a41d1536f","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-14T14:38:39Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0cfccb7e-997f-4543-b178-22d3041ce26a","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-8442f2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2\",\"requestedSubscription\":\"e2e-rate-iso-a-152792\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-14T14:38:39Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0cfccb7e-997f-4543-b178-22d3041ce26a","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-8442f2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-8442f2","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-152792","namespace":"ai-tenant-e2e-shared-a-8442f2","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-14T14:38:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0cfccb7e-997f-4543-b178-22d3041ce26a","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T14:38:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0cfccb7e-997f-4543-b178-22d3041ce26a","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:38:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0cfccb7e-997f-4543-b178-22d3041ce26a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:38:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0cfccb7e-997f-4543-b178-22d3041ce26a","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:38:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0cfccb7e-997f-4543-b178-22d3041ce26a","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-8442f2/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:38:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0cfccb7e-997f-4543-b178-22d3041ce26a","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-14T14:38:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0cfccb7e-997f-4543-b178-22d3041ce26a","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-152792"}
{"level":"debug","ts":"2026-07-14T14:38:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0cfccb7e-997f-4543-b178-22d3041ce26a","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-14T14:38:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0cfccb7e-997f-4543-b178-22d3041ce26a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"d7a19557-38c0-4402-a839-a95a41d1536f","keyName":"e2e-rate-a-152792","selected_subscription":"e2e-rate-iso-a-152792","selected_subscription_key":"ai-tenant-e2e-shared-a-8442f2/e2e-rate-iso-a-152792@ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-8442f2","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-152792","namespace":"ai-tenant-e2e-shared-a-8442f2","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-14T14:38:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0cfccb7e-997f-4543-b178-22d3041ce26a","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-14T14:38:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0cfccb7e-997f-4543-b178-22d3041ce26a","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-14T14:38:40Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"91bf22ff-f763-4150-806c-4315c2d1c229","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:34822","PortSpecifier":{"PortValue":34822}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"91bf22ff-f763-4150-806c-4315c2d1c229","method":"POST","path":"/ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2/v1/completions","host":"e2e-shared-a-8442f2.apps.dd9d6126-2103-4067-bfcb-65a9b54ce21c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-14T14:38:40Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"91bf22ff-f763-4150-806c-4315c2d1c229","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:34822","PortSpecifier":{"PortValue":34822}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784039920,"nanos":196229998},"http":{"id":"91bf22ff-f763-4150-806c-4315c2d1c229","method":"POST","headers":{":authority":"e2e-shared-a-8442f2.apps.dd9d6126-2103-4067-bfcb-65a9b54ce21c.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T14:38:40Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"91bf22ff-f763-4150-806c-4315c2d1c229","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-8oalYCYCPIrxXOzj_FFq3URWJcpuFjG7ncJUiIZNRJE9zXBszJlDVBttx3h7"}
{"level":"debug","ts":"2026-07-14T14:38:40Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"91bf22ff-f763-4150-806c-4315c2d1c229","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-8442f2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-8oalYCYCPIrxXOzj_FFq3URWJcpuFjG7ncJUiIZNRJE9zXBszJlDVBttx3h7\"}"}
{"level":"debug","ts":"2026-07-14T14:38:40Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"91bf22ff-f763-4150-806c-4315c2d1c229","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-8442f2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"d7a19557-38c0-4402-a839-a95a41d1536f","keyName":"e2e-rate-a-152792","subscription":"e2e-rate-iso-a-152792","tenant":"e2e-shared-a-8442f2","userId":"d7a19557-38c0-4402-a839-a95a41d1536f","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-14T14:38:40Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"91bf22ff-f763-4150-806c-4315c2d1c229","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-8442f2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2\",\"requestedSubscription\":\"e2e-rate-iso-a-152792\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-14T14:38:40Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"91bf22ff-f763-4150-806c-4315c2d1c229","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-8442f2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-8442f2","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-152792","namespace":"ai-tenant-e2e-shared-a-8442f2","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-14T14:38:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"91bf22ff-f763-4150-806c-4315c2d1c229","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T14:38:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"91bf22ff-f763-4150-806c-4315c2d1c229","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:38:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"91bf22ff-f763-4150-806c-4315c2d1c229","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:38:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"91bf22ff-f763-4150-806c-4315c2d1c229","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:38:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"91bf22ff-f763-4150-806c-4315c2d1c229","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-8442f2/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:38:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"91bf22ff-f763-4150-806c-4315c2d1c229","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-14T14:38:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"91bf22ff-f763-4150-806c-4315c2d1c229","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-14T14:38:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"91bf22ff-f763-4150-806c-4315c2d1c229","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-152792"}
{"level":"debug","ts":"2026-07-14T14:38:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"91bf22ff-f763-4150-806c-4315c2d1c229","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"d7a19557-38c0-4402-a839-a95a41d1536f","keyName":"e2e-rate-a-152792","selected_subscription":"e2e-rate-iso-a-152792","selected_subscription_key":"ai-tenant-e2e-shared-a-8442f2/e2e-rate-iso-a-152792@ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-8442f2","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-152792","namespace":"ai-tenant-e2e-shared-a-8442f2","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-14T14:38:40Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"91bf22ff-f763-4150-806c-4315c2d1c229","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-14T14:38:40Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"91bf22ff-f763-4150-806c-4315c2d1c229","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-14T14:38:41Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d65bafa3-d369-4e25-acc9-f779fe9783e2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:35350","PortSpecifier":{"PortValue":35350}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d65bafa3-d369-4e25-acc9-f779fe9783e2","method":"POST","path":"/ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2/v1/completions","host":"e2e-shared-a-8442f2.apps.dd9d6126-2103-4067-bfcb-65a9b54ce21c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-14T14:38:41Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d65bafa3-d369-4e25-acc9-f779fe9783e2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:35350","PortSpecifier":{"PortValue":35350}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784039921,"nanos":246017679},"http":{"id":"d65bafa3-d369-4e25-acc9-f779fe9783e2","method":"POST","headers":{":authority":"e2e-shared-a-8442f2.apps.dd9d6126-2103-4067-bfcb-65a9b54ce21c.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T14:38:41Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d65bafa3-d369-4e25-acc9-f779fe9783e2","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-8oalYCYCPIrxXOzj_FFq3URWJcpuFjG7ncJUiIZNRJE9zXBszJlDVBttx3h7"}
{"level":"debug","ts":"2026-07-14T14:38:41Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d65bafa3-d369-4e25-acc9-f779fe9783e2","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-8442f2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-8oalYCYCPIrxXOzj_FFq3URWJcpuFjG7ncJUiIZNRJE9zXBszJlDVBttx3h7\"}"}
{"level":"debug","ts":"2026-07-14T14:38:41Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d65bafa3-d369-4e25-acc9-f779fe9783e2","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-8442f2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"d7a19557-38c0-4402-a839-a95a41d1536f","keyName":"e2e-rate-a-152792","subscription":"e2e-rate-iso-a-152792","tenant":"e2e-shared-a-8442f2","userId":"d7a19557-38c0-4402-a839-a95a41d1536f","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-14T14:38:41Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d65bafa3-d369-4e25-acc9-f779fe9783e2","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-8442f2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2\",\"requestedSubscription\":\"e2e-rate-iso-a-152792\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-14T14:38:41Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d65bafa3-d369-4e25-acc9-f779fe9783e2","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-8442f2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-8442f2","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-152792","namespace":"ai-tenant-e2e-shared-a-8442f2","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-14T14:38:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d65bafa3-d369-4e25-acc9-f779fe9783e2","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T14:38:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d65bafa3-d369-4e25-acc9-f779fe9783e2","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:38:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d65bafa3-d369-4e25-acc9-f779fe9783e2","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:38:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d65bafa3-d369-4e25-acc9-f779fe9783e2","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:38:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d65bafa3-d369-4e25-acc9-f779fe9783e2","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-8442f2/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:38:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d65bafa3-d369-4e25-acc9-f779fe9783e2","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-14T14:38:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d65bafa3-d369-4e25-acc9-f779fe9783e2","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-152792"}
{"level":"debug","ts":"2026-07-14T14:38:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d65bafa3-d369-4e25-acc9-f779fe9783e2","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-14T14:38:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d65bafa3-d369-4e25-acc9-f779fe9783e2","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"d7a19557-38c0-4402-a839-a95a41d1536f","keyName":"e2e-rate-a-152792","selected_subscription":"e2e-rate-iso-a-152792","selected_subscription_key":"ai-tenant-e2e-shared-a-8442f2/e2e-rate-iso-a-152792@ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-8442f2","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-152792","namespace":"ai-tenant-e2e-shared-a-8442f2","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-14T14:38:41Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d65bafa3-d369-4e25-acc9-f779fe9783e2","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-14T14:38:41Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d65bafa3-d369-4e25-acc9-f779fe9783e2","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-14T14:38:42Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"91a87673-3d21-4ccd-9017-748f1a2c28f6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:35366","PortSpecifier":{"PortValue":35366}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"91a87673-3d21-4ccd-9017-748f1a2c28f6","method":"POST","path":"/ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2/v1/completions","host":"e2e-shared-a-8442f2.apps.dd9d6126-2103-4067-bfcb-65a9b54ce21c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-14T14:38:42Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"91a87673-3d21-4ccd-9017-748f1a2c28f6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:35366","PortSpecifier":{"PortValue":35366}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784039922,"nanos":287345377},"http":{"id":"91a87673-3d21-4ccd-9017-748f1a2c28f6","method":"POST","headers":{":authority":"e2e-shared-a-8442f2.apps.dd9d6126-2103-4067-bfcb-65a9b54ce21c.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T14:38:42Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"91a87673-3d21-4ccd-9017-748f1a2c28f6","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-8oalYCYCPIrxXOzj_FFq3URWJcpuFjG7ncJUiIZNRJE9zXBszJlDVBttx3h7"}
{"level":"debug","ts":"2026-07-14T14:38:42Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"91a87673-3d21-4ccd-9017-748f1a2c28f6","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-8442f2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-8oalYCYCPIrxXOzj_FFq3URWJcpuFjG7ncJUiIZNRJE9zXBszJlDVBttx3h7\"}"}
{"level":"debug","ts":"2026-07-14T14:38:42Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"91a87673-3d21-4ccd-9017-748f1a2c28f6","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-8442f2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"d7a19557-38c0-4402-a839-a95a41d1536f","keyName":"e2e-rate-a-152792","subscription":"e2e-rate-iso-a-152792","tenant":"e2e-shared-a-8442f2","userId":"d7a19557-38c0-4402-a839-a95a41d1536f","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-14T14:38:42Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"91a87673-3d21-4ccd-9017-748f1a2c28f6","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-8442f2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2\",\"requestedSubscription\":\"e2e-rate-iso-a-152792\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-14T14:38:42Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"91a87673-3d21-4ccd-9017-748f1a2c28f6","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-8442f2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-8442f2","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-152792","namespace":"ai-tenant-e2e-shared-a-8442f2","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-14T14:38:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"91a87673-3d21-4ccd-9017-748f1a2c28f6","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T14:38:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"91a87673-3d21-4ccd-9017-748f1a2c28f6","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:38:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"91a87673-3d21-4ccd-9017-748f1a2c28f6","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:38:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"91a87673-3d21-4ccd-9017-748f1a2c28f6","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:38:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"91a87673-3d21-4ccd-9017-748f1a2c28f6","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-8442f2/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:38:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"91a87673-3d21-4ccd-9017-748f1a2c28f6","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-14T14:38:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"91a87673-3d21-4ccd-9017-748f1a2c28f6","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-152792"}
{"level":"debug","ts":"2026-07-14T14:38:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"91a87673-3d21-4ccd-9017-748f1a2c28f6","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-14T14:38:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"91a87673-3d21-4ccd-9017-748f1a2c28f6","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"d7a19557-38c0-4402-a839-a95a41d1536f","keyName":"e2e-rate-a-152792","selected_subscription":"e2e-rate-iso-a-152792","selected_subscription_key":"ai-tenant-e2e-shared-a-8442f2/e2e-rate-iso-a-152792@ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-8442f2","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-152792","namespace":"ai-tenant-e2e-shared-a-8442f2","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-14T14:38:42Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"91a87673-3d21-4ccd-9017-748f1a2c28f6","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-14T14:38:42Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"91a87673-3d21-4ccd-9017-748f1a2c28f6","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-14T14:38:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e3707504-e295-4829-8ba6-508f11bd72e5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:53044","PortSpecifier":{"PortValue":53044}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e3707504-e295-4829-8ba6-508f11bd72e5","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-8442f2.apps.dd9d6126-2103-4067-bfcb-65a9b54ce21c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-14T14:38:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e3707504-e295-4829-8ba6-508f11bd72e5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:53044","PortSpecifier":{"PortValue":53044}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784039931,"nanos":204887559},"http":{"id":"e3707504-e295-4829-8ba6-508f11bd72e5","method":"POST","headers":{":authority":"e2e-shared-a-8442f2.apps.dd9d6126-2103-4067-bfcb-65a9b54ce21c.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T14:38:51Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"e3707504-e295-4829-8ba6-508f11bd72e5","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-14T14:38:51Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e3707504-e295-4829-8ba6-508f11bd72e5","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"f61b082d-dfd5-43f3-989e-d05902e01343","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=f60cccb0-6c6b-4590-924d-57d22aafc60c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/65a9b54ce21c"]}}
{"level":"debug","ts":"2026-07-14T14:38:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e3707504-e295-4829-8ba6-508f11bd72e5","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/65a9b54ce21c"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=f60cccb0-6c6b-4590-924d-57d22aafc60c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"f61b082d-dfd5-43f3-989e-d05902e01343","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"bbdbd5aa1b919985e447ece3303413dc26151acf3f244b3462b6ea862b3d3968"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.57:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-8442f2.apps.dd9d6126-2103-4067-bfcb-65a9b54ce21c.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T14:38:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e3707504-e295-4829-8ba6-508f11bd72e5","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:38:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e3707504-e295-4829-8ba6-508f11bd72e5","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:38:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e3707504-e295-4829-8ba6-508f11bd72e5","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-8442f2/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:38:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"e3707504-e295-4829-8ba6-508f11bd72e5","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-14T14:38:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e3707504-e295-4829-8ba6-508f11bd72e5","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-14T14:38:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e3707504-e295-4829-8ba6-508f11bd72e5","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-14T14:38:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e3707504-e295-4829-8ba6-508f11bd72e5","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-14T14:38:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e3707504-e295-4829-8ba6-508f11bd72e5","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-14T14:38:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"03c0a14d-cd95-488e-a03f-2115f79035aa","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:54694","PortSpecifier":{"PortValue":54694}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"03c0a14d-cd95-488e-a03f-2115f79035aa","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-f8f81e.apps.dd9d6126-2103-4067-bfcb-65a9b54ce21c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-14T14:38:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"03c0a14d-cd95-488e-a03f-2115f79035aa","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:54694","PortSpecifier":{"PortValue":54694}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784039931,"nanos":249670456},"http":{"id":"03c0a14d-cd95-488e-a03f-2115f79035aa","method":"POST","headers":{":authority":"e2e-shared-b-f8f81e.apps.dd9d6126-2103-4067-bfcb-65a9b54ce21c.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T14:38:51Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"03c0a14d-cd95-488e-a03f-2115f79035aa","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-14T14:38:51Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"03c0a14d-cd95-488e-a03f-2115f79035aa","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"f61b082d-dfd5-43f3-989e-d05902e01343","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=f60cccb0-6c6b-4590-924d-57d22aafc60c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/65a9b54ce21c"]}}
{"level":"debug","ts":"2026-07-14T14:38:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"03c0a14d-cd95-488e-a03f-2115f79035aa","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/65a9b54ce21c"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=f60cccb0-6c6b-4590-924d-57d22aafc60c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"f61b082d-dfd5-43f3-989e-d05902e01343","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"95f215820b0caa307c8e4aa64730562f3168e38c696151615873203a0390d66a"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.58:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-f8f81e.apps.dd9d6126-2103-4067-bfcb-65a9b54ce21c.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T14:38:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"03c0a14d-cd95-488e-a03f-2115f79035aa","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:38:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"03c0a14d-cd95-488e-a03f-2115f79035aa","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:38:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"03c0a14d-cd95-488e-a03f-2115f79035aa","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-f8f81e/rate-test-model-f8f81e\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-f8f81e/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:38:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"03c0a14d-cd95-488e-a03f-2115f79035aa","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-14T14:38:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"03c0a14d-cd95-488e-a03f-2115f79035aa","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-14T14:38:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"03c0a14d-cd95-488e-a03f-2115f79035aa","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-14T14:38:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"03c0a14d-cd95-488e-a03f-2115f79035aa","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-14T14:38:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"03c0a14d-cd95-488e-a03f-2115f79035aa","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-14T14:38:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"632e5396-f9a6-427a-92cc-4df41cbd001e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:53060","PortSpecifier":{"PortValue":53060}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"632e5396-f9a6-427a-92cc-4df41cbd001e","method":"POST","path":"/ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2/v1/completions","host":"e2e-shared-a-8442f2.apps.dd9d6126-2103-4067-bfcb-65a9b54ce21c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-14T14:38:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"632e5396-f9a6-427a-92cc-4df41cbd001e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:53060","PortSpecifier":{"PortValue":53060}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784039931,"nanos":284622543},"http":{"id":"632e5396-f9a6-427a-92cc-4df41cbd001e","method":"POST","headers":{":authority":"e2e-shared-a-8442f2.apps.dd9d6126-2103-4067-bfcb-65a9b54ce21c.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T14:38:51Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"632e5396-f9a6-427a-92cc-4df41cbd001e","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-qet2K111hMI3HjP5_pEF5q17NaAZ9GgTFIUCpQfvzzEyF5YrUEjIa1LMwDfR"}
{"level":"debug","ts":"2026-07-14T14:38:51Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"632e5396-f9a6-427a-92cc-4df41cbd001e","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-8442f2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-qet2K111hMI3HjP5_pEF5q17NaAZ9GgTFIUCpQfvzzEyF5YrUEjIa1LMwDfR\"}"}
{"level":"debug","ts":"2026-07-14T14:38:51Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"632e5396-f9a6-427a-92cc-4df41cbd001e","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-8442f2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"4c3e35c2-1a91-48b2-b256-002a03c07c23","keyName":"e2e-rate-a-4b13f9","subscription":"e2e-rate-iso-a-4b13f9","tenant":"e2e-shared-a-8442f2","userId":"4c3e35c2-1a91-48b2-b256-002a03c07c23","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-14T14:38:51Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"632e5396-f9a6-427a-92cc-4df41cbd001e","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-8442f2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2\",\"requestedSubscription\":\"e2e-rate-iso-a-4b13f9\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-14T14:38:51Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"632e5396-f9a6-427a-92cc-4df41cbd001e","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-8442f2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-8442f2","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-4b13f9","namespace":"ai-tenant-e2e-shared-a-8442f2","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-14T14:38:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"632e5396-f9a6-427a-92cc-4df41cbd001e","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T14:38:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"632e5396-f9a6-427a-92cc-4df41cbd001e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:38:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"632e5396-f9a6-427a-92cc-4df41cbd001e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:38:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"632e5396-f9a6-427a-92cc-4df41cbd001e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-8442f2/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:38:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"632e5396-f9a6-427a-92cc-4df41cbd001e","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:38:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"632e5396-f9a6-427a-92cc-4df41cbd001e","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-14T14:38:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"632e5396-f9a6-427a-92cc-4df41cbd001e","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-4b13f9"}
{"level":"debug","ts":"2026-07-14T14:38:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"632e5396-f9a6-427a-92cc-4df41cbd001e","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-14T14:38:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"632e5396-f9a6-427a-92cc-4df41cbd001e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"4c3e35c2-1a91-48b2-b256-002a03c07c23","keyName":"e2e-rate-a-4b13f9","selected_subscription":"e2e-rate-iso-a-4b13f9","selected_subscription_key":"ai-tenant-e2e-shared-a-8442f2/e2e-rate-iso-a-4b13f9@ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-8442f2","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-4b13f9","namespace":"ai-tenant-e2e-shared-a-8442f2","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-14T14:38:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"632e5396-f9a6-427a-92cc-4df41cbd001e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-14T14:38:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"632e5396-f9a6-427a-92cc-4df41cbd001e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-14T14:38:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b3462bcf-61e3-4f71-9b05-b7ec1bf1827e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:53068","PortSpecifier":{"PortValue":53068}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b3462bcf-61e3-4f71-9b05-b7ec1bf1827e","method":"POST","path":"/ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2/v1/completions","host":"e2e-shared-a-8442f2.apps.dd9d6126-2103-4067-bfcb-65a9b54ce21c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-14T14:38:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b3462bcf-61e3-4f71-9b05-b7ec1bf1827e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:53068","PortSpecifier":{"PortValue":53068}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784039932,"nanos":347058013},"http":{"id":"b3462bcf-61e3-4f71-9b05-b7ec1bf1827e","method":"POST","headers":{":authority":"e2e-shared-a-8442f2.apps.dd9d6126-2103-4067-bfcb-65a9b54ce21c.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T14:38:52Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b3462bcf-61e3-4f71-9b05-b7ec1bf1827e","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-qet2K111hMI3HjP5_pEF5q17NaAZ9GgTFIUCpQfvzzEyF5YrUEjIa1LMwDfR"}
{"level":"debug","ts":"2026-07-14T14:38:52Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b3462bcf-61e3-4f71-9b05-b7ec1bf1827e","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-8442f2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-qet2K111hMI3HjP5_pEF5q17NaAZ9GgTFIUCpQfvzzEyF5YrUEjIa1LMwDfR\"}"}
{"level":"debug","ts":"2026-07-14T14:38:52Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b3462bcf-61e3-4f71-9b05-b7ec1bf1827e","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-8442f2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"4c3e35c2-1a91-48b2-b256-002a03c07c23","keyName":"e2e-rate-a-4b13f9","subscription":"e2e-rate-iso-a-4b13f9","tenant":"e2e-shared-a-8442f2","userId":"4c3e35c2-1a91-48b2-b256-002a03c07c23","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-14T14:38:52Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b3462bcf-61e3-4f71-9b05-b7ec1bf1827e","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-8442f2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2\",\"requestedSubscription\":\"e2e-rate-iso-a-4b13f9\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-14T14:38:52Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b3462bcf-61e3-4f71-9b05-b7ec1bf1827e","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-8442f2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-8442f2","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-4b13f9","namespace":"ai-tenant-e2e-shared-a-8442f2","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-14T14:38:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b3462bcf-61e3-4f71-9b05-b7ec1bf1827e","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T14:38:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b3462bcf-61e3-4f71-9b05-b7ec1bf1827e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:38:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b3462bcf-61e3-4f71-9b05-b7ec1bf1827e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:38:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b3462bcf-61e3-4f71-9b05-b7ec1bf1827e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-8442f2/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:38:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b3462bcf-61e3-4f71-9b05-b7ec1bf1827e","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:38:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b3462bcf-61e3-4f71-9b05-b7ec1bf1827e","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-14T14:38:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b3462bcf-61e3-4f71-9b05-b7ec1bf1827e","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-4b13f9"}
{"level":"debug","ts":"2026-07-14T14:38:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b3462bcf-61e3-4f71-9b05-b7ec1bf1827e","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-14T14:38:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b3462bcf-61e3-4f71-9b05-b7ec1bf1827e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"4c3e35c2-1a91-48b2-b256-002a03c07c23","keyName":"e2e-rate-a-4b13f9","selected_subscription":"e2e-rate-iso-a-4b13f9","selected_subscription_key":"ai-tenant-e2e-shared-a-8442f2/e2e-rate-iso-a-4b13f9@ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-8442f2","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-4b13f9","namespace":"ai-tenant-e2e-shared-a-8442f2","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-14T14:38:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b3462bcf-61e3-4f71-9b05-b7ec1bf1827e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-14T14:38:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b3462bcf-61e3-4f71-9b05-b7ec1bf1827e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-14T14:38:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6dfde9ae-ed9d-4874-bd9f-fb7ef210cae7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:53084","PortSpecifier":{"PortValue":53084}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6dfde9ae-ed9d-4874-bd9f-fb7ef210cae7","method":"POST","path":"/ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2/v1/completions","host":"e2e-shared-a-8442f2.apps.dd9d6126-2103-4067-bfcb-65a9b54ce21c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-14T14:38:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6dfde9ae-ed9d-4874-bd9f-fb7ef210cae7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:53084","PortSpecifier":{"PortValue":53084}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784039933,"nanos":397400561},"http":{"id":"6dfde9ae-ed9d-4874-bd9f-fb7ef210cae7","method":"POST","headers":{":authority":"e2e-shared-a-8442f2.apps.dd9d6126-2103-4067-bfcb-65a9b54ce21c.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T14:38:53Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6dfde9ae-ed9d-4874-bd9f-fb7ef210cae7","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-qet2K111hMI3HjP5_pEF5q17NaAZ9GgTFIUCpQfvzzEyF5YrUEjIa1LMwDfR"}
{"level":"debug","ts":"2026-07-14T14:38:53Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6dfde9ae-ed9d-4874-bd9f-fb7ef210cae7","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-8442f2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-qet2K111hMI3HjP5_pEF5q17NaAZ9GgTFIUCpQfvzzEyF5YrUEjIa1LMwDfR\"}"}
{"level":"debug","ts":"2026-07-14T14:38:53Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6dfde9ae-ed9d-4874-bd9f-fb7ef210cae7","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-8442f2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"4c3e35c2-1a91-48b2-b256-002a03c07c23","keyName":"e2e-rate-a-4b13f9","subscription":"e2e-rate-iso-a-4b13f9","tenant":"e2e-shared-a-8442f2","userId":"4c3e35c2-1a91-48b2-b256-002a03c07c23","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-14T14:38:53Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6dfde9ae-ed9d-4874-bd9f-fb7ef210cae7","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-8442f2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2\",\"requestedSubscription\":\"e2e-rate-iso-a-4b13f9\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-14T14:38:53Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6dfde9ae-ed9d-4874-bd9f-fb7ef210cae7","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-8442f2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-8442f2","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-4b13f9","namespace":"ai-tenant-e2e-shared-a-8442f2","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-14T14:38:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6dfde9ae-ed9d-4874-bd9f-fb7ef210cae7","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T14:38:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6dfde9ae-ed9d-4874-bd9f-fb7ef210cae7","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:38:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6dfde9ae-ed9d-4874-bd9f-fb7ef210cae7","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:38:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6dfde9ae-ed9d-4874-bd9f-fb7ef210cae7","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:38:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6dfde9ae-ed9d-4874-bd9f-fb7ef210cae7","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-8442f2/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:38:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6dfde9ae-ed9d-4874-bd9f-fb7ef210cae7","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-14T14:38:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6dfde9ae-ed9d-4874-bd9f-fb7ef210cae7","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-14T14:38:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6dfde9ae-ed9d-4874-bd9f-fb7ef210cae7","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-4b13f9"}
{"level":"debug","ts":"2026-07-14T14:38:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6dfde9ae-ed9d-4874-bd9f-fb7ef210cae7","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"4c3e35c2-1a91-48b2-b256-002a03c07c23","keyName":"e2e-rate-a-4b13f9","selected_subscription":"e2e-rate-iso-a-4b13f9","selected_subscription_key":"ai-tenant-e2e-shared-a-8442f2/e2e-rate-iso-a-4b13f9@ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-8442f2","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-4b13f9","namespace":"ai-tenant-e2e-shared-a-8442f2","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-14T14:38:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6dfde9ae-ed9d-4874-bd9f-fb7ef210cae7","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-14T14:38:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6dfde9ae-ed9d-4874-bd9f-fb7ef210cae7","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-14T14:38:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5b890d16-227c-4a77-a24a-62f02a1290d7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:53092","PortSpecifier":{"PortValue":53092}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5b890d16-227c-4a77-a24a-62f02a1290d7","method":"POST","path":"/ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2/v1/completions","host":"e2e-shared-a-8442f2.apps.dd9d6126-2103-4067-bfcb-65a9b54ce21c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-14T14:38:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5b890d16-227c-4a77-a24a-62f02a1290d7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:53092","PortSpecifier":{"PortValue":53092}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784039934,"nanos":434212682},"http":{"id":"5b890d16-227c-4a77-a24a-62f02a1290d7","method":"POST","headers":{":authority":"e2e-shared-a-8442f2.apps.dd9d6126-2103-4067-bfcb-65a9b54ce21c.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T14:38:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5b890d16-227c-4a77-a24a-62f02a1290d7","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-qet2K111hMI3HjP5_pEF5q17NaAZ9GgTFIUCpQfvzzEyF5YrUEjIa1LMwDfR"}
{"level":"debug","ts":"2026-07-14T14:38:54Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5b890d16-227c-4a77-a24a-62f02a1290d7","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-8442f2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-qet2K111hMI3HjP5_pEF5q17NaAZ9GgTFIUCpQfvzzEyF5YrUEjIa1LMwDfR\"}"}
{"level":"debug","ts":"2026-07-14T14:38:54Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5b890d16-227c-4a77-a24a-62f02a1290d7","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-8442f2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"4c3e35c2-1a91-48b2-b256-002a03c07c23","keyName":"e2e-rate-a-4b13f9","subscription":"e2e-rate-iso-a-4b13f9","tenant":"e2e-shared-a-8442f2","userId":"4c3e35c2-1a91-48b2-b256-002a03c07c23","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-14T14:38:54Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5b890d16-227c-4a77-a24a-62f02a1290d7","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-8442f2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2\",\"requestedSubscription\":\"e2e-rate-iso-a-4b13f9\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-14T14:38:54Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5b890d16-227c-4a77-a24a-62f02a1290d7","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-8442f2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-8442f2","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-4b13f9","namespace":"ai-tenant-e2e-shared-a-8442f2","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-14T14:38:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5b890d16-227c-4a77-a24a-62f02a1290d7","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T14:38:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5b890d16-227c-4a77-a24a-62f02a1290d7","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:38:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5b890d16-227c-4a77-a24a-62f02a1290d7","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:38:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5b890d16-227c-4a77-a24a-62f02a1290d7","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-8442f2/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:38:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5b890d16-227c-4a77-a24a-62f02a1290d7","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:38:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5b890d16-227c-4a77-a24a-62f02a1290d7","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-14T14:38:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5b890d16-227c-4a77-a24a-62f02a1290d7","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-14T14:38:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5b890d16-227c-4a77-a24a-62f02a1290d7","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-4b13f9"}
{"level":"debug","ts":"2026-07-14T14:38:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5b890d16-227c-4a77-a24a-62f02a1290d7","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"4c3e35c2-1a91-48b2-b256-002a03c07c23","keyName":"e2e-rate-a-4b13f9","selected_subscription":"e2e-rate-iso-a-4b13f9","selected_subscription_key":"ai-tenant-e2e-shared-a-8442f2/e2e-rate-iso-a-4b13f9@ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-8442f2","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-4b13f9","namespace":"ai-tenant-e2e-shared-a-8442f2","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-14T14:38:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5b890d16-227c-4a77-a24a-62f02a1290d7","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-14T14:38:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5b890d16-227c-4a77-a24a-62f02a1290d7","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-14T14:38:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f647e2c7-359a-41c5-a45e-484270dbd2bd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:53100","PortSpecifier":{"PortValue":53100}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f647e2c7-359a-41c5-a45e-484270dbd2bd","method":"POST","path":"/ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2/v1/completions","host":"e2e-shared-a-8442f2.apps.dd9d6126-2103-4067-bfcb-65a9b54ce21c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-14T14:38:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f647e2c7-359a-41c5-a45e-484270dbd2bd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:53100","PortSpecifier":{"PortValue":53100}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784039935,"nanos":474460107},"http":{"id":"f647e2c7-359a-41c5-a45e-484270dbd2bd","method":"POST","headers":{":authority":"e2e-shared-a-8442f2.apps.dd9d6126-2103-4067-bfcb-65a9b54ce21c.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T14:38:55Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f647e2c7-359a-41c5-a45e-484270dbd2bd","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-qet2K111hMI3HjP5_pEF5q17NaAZ9GgTFIUCpQfvzzEyF5YrUEjIa1LMwDfR"}
{"level":"debug","ts":"2026-07-14T14:38:55Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f647e2c7-359a-41c5-a45e-484270dbd2bd","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-8442f2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-qet2K111hMI3HjP5_pEF5q17NaAZ9GgTFIUCpQfvzzEyF5YrUEjIa1LMwDfR\"}"}
{"level":"debug","ts":"2026-07-14T14:38:55Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f647e2c7-359a-41c5-a45e-484270dbd2bd","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-8442f2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"4c3e35c2-1a91-48b2-b256-002a03c07c23","keyName":"e2e-rate-a-4b13f9","subscription":"e2e-rate-iso-a-4b13f9","tenant":"e2e-shared-a-8442f2","userId":"4c3e35c2-1a91-48b2-b256-002a03c07c23","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-14T14:38:55Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f647e2c7-359a-41c5-a45e-484270dbd2bd","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-8442f2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2\",\"requestedSubscription\":\"e2e-rate-iso-a-4b13f9\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-14T14:38:55Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f647e2c7-359a-41c5-a45e-484270dbd2bd","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-8442f2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-8442f2","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-4b13f9","namespace":"ai-tenant-e2e-shared-a-8442f2","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-14T14:38:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f647e2c7-359a-41c5-a45e-484270dbd2bd","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T14:38:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f647e2c7-359a-41c5-a45e-484270dbd2bd","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:38:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f647e2c7-359a-41c5-a45e-484270dbd2bd","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:38:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f647e2c7-359a-41c5-a45e-484270dbd2bd","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-8442f2/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:38:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f647e2c7-359a-41c5-a45e-484270dbd2bd","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:38:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f647e2c7-359a-41c5-a45e-484270dbd2bd","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-14T14:38:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f647e2c7-359a-41c5-a45e-484270dbd2bd","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-4b13f9"}
{"level":"debug","ts":"2026-07-14T14:38:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f647e2c7-359a-41c5-a45e-484270dbd2bd","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-14T14:38:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f647e2c7-359a-41c5-a45e-484270dbd2bd","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"4c3e35c2-1a91-48b2-b256-002a03c07c23","keyName":"e2e-rate-a-4b13f9","selected_subscription":"e2e-rate-iso-a-4b13f9","selected_subscription_key":"ai-tenant-e2e-shared-a-8442f2/e2e-rate-iso-a-4b13f9@ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-8442f2","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-4b13f9","namespace":"ai-tenant-e2e-shared-a-8442f2","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-14T14:38:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f647e2c7-359a-41c5-a45e-484270dbd2bd","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-14T14:38:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f647e2c7-359a-41c5-a45e-484270dbd2bd","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-14T14:38:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"62a52f5b-c2d8-4865-bd07-c63810f61fb0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:53102","PortSpecifier":{"PortValue":53102}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"62a52f5b-c2d8-4865-bd07-c63810f61fb0","method":"POST","path":"/ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2/v1/completions","host":"e2e-shared-a-8442f2.apps.dd9d6126-2103-4067-bfcb-65a9b54ce21c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-14T14:38:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"62a52f5b-c2d8-4865-bd07-c63810f61fb0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:53102","PortSpecifier":{"PortValue":53102}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784039936,"nanos":522589083},"http":{"id":"62a52f5b-c2d8-4865-bd07-c63810f61fb0","method":"POST","headers":{":authority":"e2e-shared-a-8442f2.apps.dd9d6126-2103-4067-bfcb-65a9b54ce21c.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T14:38:56Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"62a52f5b-c2d8-4865-bd07-c63810f61fb0","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-qet2K111hMI3HjP5_pEF5q17NaAZ9GgTFIUCpQfvzzEyF5YrUEjIa1LMwDfR"}
{"level":"debug","ts":"2026-07-14T14:38:56Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"62a52f5b-c2d8-4865-bd07-c63810f61fb0","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-8442f2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-qet2K111hMI3HjP5_pEF5q17NaAZ9GgTFIUCpQfvzzEyF5YrUEjIa1LMwDfR\"}"}
{"level":"debug","ts":"2026-07-14T14:38:56Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"62a52f5b-c2d8-4865-bd07-c63810f61fb0","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-8442f2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"4c3e35c2-1a91-48b2-b256-002a03c07c23","keyName":"e2e-rate-a-4b13f9","subscription":"e2e-rate-iso-a-4b13f9","tenant":"e2e-shared-a-8442f2","userId":"4c3e35c2-1a91-48b2-b256-002a03c07c23","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-14T14:38:56Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"62a52f5b-c2d8-4865-bd07-c63810f61fb0","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-8442f2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2\",\"requestedSubscription\":\"e2e-rate-iso-a-4b13f9\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-14T14:38:56Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"62a52f5b-c2d8-4865-bd07-c63810f61fb0","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-8442f2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-8442f2","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-4b13f9","namespace":"ai-tenant-e2e-shared-a-8442f2","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-14T14:38:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"62a52f5b-c2d8-4865-bd07-c63810f61fb0","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T14:38:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"62a52f5b-c2d8-4865-bd07-c63810f61fb0","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:38:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"62a52f5b-c2d8-4865-bd07-c63810f61fb0","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:38:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"62a52f5b-c2d8-4865-bd07-c63810f61fb0","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:38:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"62a52f5b-c2d8-4865-bd07-c63810f61fb0","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-8442f2/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:38:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"62a52f5b-c2d8-4865-bd07-c63810f61fb0","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-14T14:38:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"62a52f5b-c2d8-4865-bd07-c63810f61fb0","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-4b13f9"}
{"level":"debug","ts":"2026-07-14T14:38:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"62a52f5b-c2d8-4865-bd07-c63810f61fb0","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-14T14:38:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"62a52f5b-c2d8-4865-bd07-c63810f61fb0","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"4c3e35c2-1a91-48b2-b256-002a03c07c23","keyName":"e2e-rate-a-4b13f9","selected_subscription":"e2e-rate-iso-a-4b13f9","selected_subscription_key":"ai-tenant-e2e-shared-a-8442f2/e2e-rate-iso-a-4b13f9@ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-8442f2","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-4b13f9","namespace":"ai-tenant-e2e-shared-a-8442f2","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-14T14:38:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"62a52f5b-c2d8-4865-bd07-c63810f61fb0","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-14T14:38:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"62a52f5b-c2d8-4865-bd07-c63810f61fb0","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-14T14:38:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"994095d5-6a77-4af4-8e0b-77bbe61a5b70","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:53116","PortSpecifier":{"PortValue":53116}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"994095d5-6a77-4af4-8e0b-77bbe61a5b70","method":"POST","path":"/ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2/v1/completions","host":"e2e-shared-a-8442f2.apps.dd9d6126-2103-4067-bfcb-65a9b54ce21c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-14T14:38:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"994095d5-6a77-4af4-8e0b-77bbe61a5b70","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:53116","PortSpecifier":{"PortValue":53116}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784039937,"nanos":561351276},"http":{"id":"994095d5-6a77-4af4-8e0b-77bbe61a5b70","method":"POST","headers":{":authority":"e2e-shared-a-8442f2.apps.dd9d6126-2103-4067-bfcb-65a9b54ce21c.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T14:38:57Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"994095d5-6a77-4af4-8e0b-77bbe61a5b70","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-qet2K111hMI3HjP5_pEF5q17NaAZ9GgTFIUCpQfvzzEyF5YrUEjIa1LMwDfR"}
{"level":"debug","ts":"2026-07-14T14:38:57Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"994095d5-6a77-4af4-8e0b-77bbe61a5b70","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-8442f2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-qet2K111hMI3HjP5_pEF5q17NaAZ9GgTFIUCpQfvzzEyF5YrUEjIa1LMwDfR\"}"}
{"level":"debug","ts":"2026-07-14T14:38:57Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"994095d5-6a77-4af4-8e0b-77bbe61a5b70","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-8442f2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"4c3e35c2-1a91-48b2-b256-002a03c07c23","keyName":"e2e-rate-a-4b13f9","subscription":"e2e-rate-iso-a-4b13f9","tenant":"e2e-shared-a-8442f2","userId":"4c3e35c2-1a91-48b2-b256-002a03c07c23","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-14T14:38:57Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"994095d5-6a77-4af4-8e0b-77bbe61a5b70","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-8442f2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2\",\"requestedSubscription\":\"e2e-rate-iso-a-4b13f9\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-14T14:38:57Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"994095d5-6a77-4af4-8e0b-77bbe61a5b70","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-8442f2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-8442f2","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-4b13f9","namespace":"ai-tenant-e2e-shared-a-8442f2","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-14T14:38:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"994095d5-6a77-4af4-8e0b-77bbe61a5b70","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T14:38:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"994095d5-6a77-4af4-8e0b-77bbe61a5b70","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:38:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"994095d5-6a77-4af4-8e0b-77bbe61a5b70","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:38:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"994095d5-6a77-4af4-8e0b-77bbe61a5b70","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-8442f2/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:38:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"994095d5-6a77-4af4-8e0b-77bbe61a5b70","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:38:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"994095d5-6a77-4af4-8e0b-77bbe61a5b70","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-14T14:38:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"994095d5-6a77-4af4-8e0b-77bbe61a5b70","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-14T14:38:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"994095d5-6a77-4af4-8e0b-77bbe61a5b70","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-4b13f9"}
{"level":"debug","ts":"2026-07-14T14:38:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"994095d5-6a77-4af4-8e0b-77bbe61a5b70","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"4c3e35c2-1a91-48b2-b256-002a03c07c23","keyName":"e2e-rate-a-4b13f9","selected_subscription":"e2e-rate-iso-a-4b13f9","selected_subscription_key":"ai-tenant-e2e-shared-a-8442f2/e2e-rate-iso-a-4b13f9@ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-8442f2","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-4b13f9","namespace":"ai-tenant-e2e-shared-a-8442f2","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-14T14:38:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"994095d5-6a77-4af4-8e0b-77bbe61a5b70","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-14T14:38:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"994095d5-6a77-4af4-8e0b-77bbe61a5b70","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-14T14:38:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b6cd659a-cc98-428c-b56d-c4169fc26a3f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:53120","PortSpecifier":{"PortValue":53120}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b6cd659a-cc98-428c-b56d-c4169fc26a3f","method":"POST","path":"/ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2/v1/completions","host":"e2e-shared-a-8442f2.apps.dd9d6126-2103-4067-bfcb-65a9b54ce21c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-14T14:38:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b6cd659a-cc98-428c-b56d-c4169fc26a3f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:53120","PortSpecifier":{"PortValue":53120}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784039938,"nanos":600675154},"http":{"id":"b6cd659a-cc98-428c-b56d-c4169fc26a3f","method":"POST","headers":{":authority":"e2e-shared-a-8442f2.apps.dd9d6126-2103-4067-bfcb-65a9b54ce21c.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T14:38:58Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b6cd659a-cc98-428c-b56d-c4169fc26a3f","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-qet2K111hMI3HjP5_pEF5q17NaAZ9GgTFIUCpQfvzzEyF5YrUEjIa1LMwDfR"}
{"level":"debug","ts":"2026-07-14T14:38:58Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b6cd659a-cc98-428c-b56d-c4169fc26a3f","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-8442f2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-qet2K111hMI3HjP5_pEF5q17NaAZ9GgTFIUCpQfvzzEyF5YrUEjIa1LMwDfR\"}"}
{"level":"debug","ts":"2026-07-14T14:38:58Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b6cd659a-cc98-428c-b56d-c4169fc26a3f","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-8442f2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"4c3e35c2-1a91-48b2-b256-002a03c07c23","keyName":"e2e-rate-a-4b13f9","subscription":"e2e-rate-iso-a-4b13f9","tenant":"e2e-shared-a-8442f2","userId":"4c3e35c2-1a91-48b2-b256-002a03c07c23","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-14T14:38:58Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b6cd659a-cc98-428c-b56d-c4169fc26a3f","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-8442f2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2\",\"requestedSubscription\":\"e2e-rate-iso-a-4b13f9\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-14T14:38:58Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b6cd659a-cc98-428c-b56d-c4169fc26a3f","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-8442f2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-8442f2","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-4b13f9","namespace":"ai-tenant-e2e-shared-a-8442f2","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-14T14:38:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b6cd659a-cc98-428c-b56d-c4169fc26a3f","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T14:38:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b6cd659a-cc98-428c-b56d-c4169fc26a3f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:38:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b6cd659a-cc98-428c-b56d-c4169fc26a3f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:38:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b6cd659a-cc98-428c-b56d-c4169fc26a3f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-8442f2/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:38:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b6cd659a-cc98-428c-b56d-c4169fc26a3f","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:38:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b6cd659a-cc98-428c-b56d-c4169fc26a3f","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-4b13f9"}
{"level":"debug","ts":"2026-07-14T14:38:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b6cd659a-cc98-428c-b56d-c4169fc26a3f","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-14T14:38:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b6cd659a-cc98-428c-b56d-c4169fc26a3f","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-14T14:38:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b6cd659a-cc98-428c-b56d-c4169fc26a3f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"4c3e35c2-1a91-48b2-b256-002a03c07c23","keyName":"e2e-rate-a-4b13f9","selected_subscription":"e2e-rate-iso-a-4b13f9","selected_subscription_key":"ai-tenant-e2e-shared-a-8442f2/e2e-rate-iso-a-4b13f9@ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-8442f2","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-4b13f9","namespace":"ai-tenant-e2e-shared-a-8442f2","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-14T14:38:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b6cd659a-cc98-428c-b56d-c4169fc26a3f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-14T14:38:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b6cd659a-cc98-428c-b56d-c4169fc26a3f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-14T14:38:59Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"02aadc67-2814-4bc3-97e9-a2078b9b6b90","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:53124","PortSpecifier":{"PortValue":53124}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"02aadc67-2814-4bc3-97e9-a2078b9b6b90","method":"POST","path":"/ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2/v1/completions","host":"e2e-shared-a-8442f2.apps.dd9d6126-2103-4067-bfcb-65a9b54ce21c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-14T14:38:59Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"02aadc67-2814-4bc3-97e9-a2078b9b6b90","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:53124","PortSpecifier":{"PortValue":53124}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784039939,"nanos":638385008},"http":{"id":"02aadc67-2814-4bc3-97e9-a2078b9b6b90","method":"POST","headers":{":authority":"e2e-shared-a-8442f2.apps.dd9d6126-2103-4067-bfcb-65a9b54ce21c.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T14:38:59Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"02aadc67-2814-4bc3-97e9-a2078b9b6b90","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-qet2K111hMI3HjP5_pEF5q17NaAZ9GgTFIUCpQfvzzEyF5YrUEjIa1LMwDfR"}
{"level":"debug","ts":"2026-07-14T14:38:59Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"02aadc67-2814-4bc3-97e9-a2078b9b6b90","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-8442f2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-qet2K111hMI3HjP5_pEF5q17NaAZ9GgTFIUCpQfvzzEyF5YrUEjIa1LMwDfR\"}"}
{"level":"debug","ts":"2026-07-14T14:38:59Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"02aadc67-2814-4bc3-97e9-a2078b9b6b90","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-8442f2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"4c3e35c2-1a91-48b2-b256-002a03c07c23","keyName":"e2e-rate-a-4b13f9","subscription":"e2e-rate-iso-a-4b13f9","tenant":"e2e-shared-a-8442f2","userId":"4c3e35c2-1a91-48b2-b256-002a03c07c23","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-14T14:38:59Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"02aadc67-2814-4bc3-97e9-a2078b9b6b90","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-8442f2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2\",\"requestedSubscription\":\"e2e-rate-iso-a-4b13f9\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-14T14:38:59Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"02aadc67-2814-4bc3-97e9-a2078b9b6b90","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-8442f2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-8442f2","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-4b13f9","namespace":"ai-tenant-e2e-shared-a-8442f2","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-14T14:38:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"02aadc67-2814-4bc3-97e9-a2078b9b6b90","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T14:38:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"02aadc67-2814-4bc3-97e9-a2078b9b6b90","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:38:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"02aadc67-2814-4bc3-97e9-a2078b9b6b90","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:38:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"02aadc67-2814-4bc3-97e9-a2078b9b6b90","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-8442f2/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:38:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"02aadc67-2814-4bc3-97e9-a2078b9b6b90","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:38:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"02aadc67-2814-4bc3-97e9-a2078b9b6b90","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-4b13f9"}
{"level":"debug","ts":"2026-07-14T14:38:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"02aadc67-2814-4bc3-97e9-a2078b9b6b90","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-14T14:38:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"02aadc67-2814-4bc3-97e9-a2078b9b6b90","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-14T14:38:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"02aadc67-2814-4bc3-97e9-a2078b9b6b90","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"4c3e35c2-1a91-48b2-b256-002a03c07c23","keyName":"e2e-rate-a-4b13f9","selected_subscription":"e2e-rate-iso-a-4b13f9","selected_subscription_key":"ai-tenant-e2e-shared-a-8442f2/e2e-rate-iso-a-4b13f9@ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-8442f2","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-4b13f9","namespace":"ai-tenant-e2e-shared-a-8442f2","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-14T14:38:59Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"02aadc67-2814-4bc3-97e9-a2078b9b6b90","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-14T14:38:59Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"02aadc67-2814-4bc3-97e9-a2078b9b6b90","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-14T14:39:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"600bd3c7-d72d-4ae6-a6f0-cc6e298f5637","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:53130","PortSpecifier":{"PortValue":53130}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"600bd3c7-d72d-4ae6-a6f0-cc6e298f5637","method":"POST","path":"/ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2/v1/completions","host":"e2e-shared-a-8442f2.apps.dd9d6126-2103-4067-bfcb-65a9b54ce21c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-14T14:39:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"600bd3c7-d72d-4ae6-a6f0-cc6e298f5637","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:53130","PortSpecifier":{"PortValue":53130}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784039940,"nanos":681898177},"http":{"id":"600bd3c7-d72d-4ae6-a6f0-cc6e298f5637","method":"POST","headers":{":authority":"e2e-shared-a-8442f2.apps.dd9d6126-2103-4067-bfcb-65a9b54ce21c.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T14:39:00Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"600bd3c7-d72d-4ae6-a6f0-cc6e298f5637","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-qet2K111hMI3HjP5_pEF5q17NaAZ9GgTFIUCpQfvzzEyF5YrUEjIa1LMwDfR"}
{"level":"debug","ts":"2026-07-14T14:39:00Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"600bd3c7-d72d-4ae6-a6f0-cc6e298f5637","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-8442f2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-qet2K111hMI3HjP5_pEF5q17NaAZ9GgTFIUCpQfvzzEyF5YrUEjIa1LMwDfR\"}"}
{"level":"debug","ts":"2026-07-14T14:39:00Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"600bd3c7-d72d-4ae6-a6f0-cc6e298f5637","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-8442f2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"4c3e35c2-1a91-48b2-b256-002a03c07c23","keyName":"e2e-rate-a-4b13f9","subscription":"e2e-rate-iso-a-4b13f9","tenant":"e2e-shared-a-8442f2","userId":"4c3e35c2-1a91-48b2-b256-002a03c07c23","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-14T14:39:00Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"600bd3c7-d72d-4ae6-a6f0-cc6e298f5637","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-8442f2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2\",\"requestedSubscription\":\"e2e-rate-iso-a-4b13f9\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-14T14:39:00Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"600bd3c7-d72d-4ae6-a6f0-cc6e298f5637","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-8442f2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-8442f2","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-4b13f9","namespace":"ai-tenant-e2e-shared-a-8442f2","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-14T14:39:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"600bd3c7-d72d-4ae6-a6f0-cc6e298f5637","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T14:39:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"600bd3c7-d72d-4ae6-a6f0-cc6e298f5637","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:39:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"600bd3c7-d72d-4ae6-a6f0-cc6e298f5637","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:39:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"600bd3c7-d72d-4ae6-a6f0-cc6e298f5637","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:39:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"600bd3c7-d72d-4ae6-a6f0-cc6e298f5637","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-8442f2/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:39:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"600bd3c7-d72d-4ae6-a6f0-cc6e298f5637","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-14T14:39:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"600bd3c7-d72d-4ae6-a6f0-cc6e298f5637","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-4b13f9"}
{"level":"debug","ts":"2026-07-14T14:39:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"600bd3c7-d72d-4ae6-a6f0-cc6e298f5637","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-14T14:39:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"600bd3c7-d72d-4ae6-a6f0-cc6e298f5637","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"4c3e35c2-1a91-48b2-b256-002a03c07c23","keyName":"e2e-rate-a-4b13f9","selected_subscription":"e2e-rate-iso-a-4b13f9","selected_subscription_key":"ai-tenant-e2e-shared-a-8442f2/e2e-rate-iso-a-4b13f9@ai-tenant-e2e-shared-a-8442f2/rate-test-model-8442f2","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-8442f2","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-4b13f9","namespace":"ai-tenant-e2e-shared-a-8442f2","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-14T14:39:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"600bd3c7-d72d-4ae6-a6f0-cc6e298f5637","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-14T14:39:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"600bd3c7-d72d-4ae6-a6f0-cc6e298f5637","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-14T14:39:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b3479194-c1b7-4e36-9eea-931b6dada367","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:54702","PortSpecifier":{"PortValue":54702}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b3479194-c1b7-4e36-9eea-931b6dada367","method":"POST","path":"/ai-tenant-e2e-shared-b-f8f81e/rate-test-model-f8f81e/v1/completions","host":"e2e-shared-b-f8f81e.apps.dd9d6126-2103-4067-bfcb-65a9b54ce21c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-14T14:39:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b3479194-c1b7-4e36-9eea-931b6dada367","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:54702","PortSpecifier":{"PortValue":54702}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784039940,"nanos":740721656},"http":{"id":"b3479194-c1b7-4e36-9eea-931b6dada367","method":"POST","headers":{":authority":"e2e-shared-b-f8f81e.apps.dd9d6126-2103-4067-bfcb-65a9b54ce21c.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-f8f81e/rate-test-model-f8f81e/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T14:39:00Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b3479194-c1b7-4e36-9eea-931b6dada367","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1RXXRrbPcc2XYnyDK_G83Xoa9wAyYNO6ge82Ofc90U4TQojcNBmzRq43vqGKR"}
{"level":"debug","ts":"2026-07-14T14:39:00Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b3479194-c1b7-4e36-9eea-931b6dada367","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-f8f81e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1RXXRrbPcc2XYnyDK_G83Xoa9wAyYNO6ge82Ofc90U4TQojcNBmzRq43vqGKR\"}"}
{"level":"debug","ts":"2026-07-14T14:39:00Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b3479194-c1b7-4e36-9eea-931b6dada367","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-f8f81e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"c5839c3e-1bcc-4b63-997e-ed8568f28c85","keyName":"e2e-rate-b-4b13f9","subscription":"e2e-rate-iso-b-4b13f9","tenant":"e2e-shared-b-f8f81e","userId":"c5839c3e-1bcc-4b63-997e-ed8568f28c85","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-14T14:39:00Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b3479194-c1b7-4e36-9eea-931b6dada367","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-f8f81e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-f8f81e/rate-test-model-f8f81e\",\"requestedSubscription\":\"e2e-rate-iso-b-4b13f9\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-14T14:39:00Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b3479194-c1b7-4e36-9eea-931b6dada367","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-f8f81e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-f8f81e","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-4b13f9","namespace":"ai-tenant-e2e-shared-b-f8f81e","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-14T14:39:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b3479194-c1b7-4e36-9eea-931b6dada367","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T14:39:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b3479194-c1b7-4e36-9eea-931b6dada367","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:39:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b3479194-c1b7-4e36-9eea-931b6dada367","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:39:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b3479194-c1b7-4e36-9eea-931b6dada367","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-f8f81e/rate-test-model-f8f81e\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-f8f81e/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:39:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b3479194-c1b7-4e36-9eea-931b6dada367","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T14:39:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b3479194-c1b7-4e36-9eea-931b6dada367","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-14T14:39:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b3479194-c1b7-4e36-9eea-931b6dada367","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-4b13f9"}
{"level":"debug","ts":"2026-07-14T14:39:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b3479194-c1b7-4e36-9eea-931b6dada367","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-14T14:39:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b3479194-c1b7-4e36-9eea-931b6dada367","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"c5839c3e-1bcc-4b63-997e-ed8568f28c85","keyName":"e2e-rate-b-4b13f9","selected_subscription":"e2e-rate-iso-b-4b13f9","selected_subscription_key":"ai-tenant-e2e-shared-b-f8f81e/e2e-rate-iso-b-4b13f9@ai-tenant-e2e-shared-b-f8f81e/rate-test-model-f8f81e","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-f8f81e","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-4b13f9","namespace":"ai-tenant-e2e-shared-b-f8f81e","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-14T14:39:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b3479194-c1b7-4e36-9eea-931b6dada367","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-14T14:39:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b3479194-c1b7-4e36-9eea-931b6dada367","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-14T14:39:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1e03efe38798796711abc864778b01055ffda75d62ad02e539b4d8de49181043"}
{"level":"info","ts":"2026-07-14T14:39:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e0e6d7236e0be3a42992259f0a03f2dd6321f54f718ed5c6f098001470a55a97"}
{"level":"info","ts":"2026-07-14T14:39:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/10954dda0fb70486a51b9b4910b03cc3a56aef1820dd64c3f69121efe162f5e4"}
{"level":"info","ts":"2026-07-14T14:39:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d296e3e4cf2e87bd7059bc40584bc2247fa64a0d26cab80b15fe648130f09acc"}
{"level":"info","ts":"2026-07-14T14:39:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/8c9ad5ee101909de2adc676bba26ae67775d5e9e7127e3269fe79d03a807fd5b"}
{"level":"info","ts":"2026-07-14T14:39:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/094510494d7caf433920f29a0330acf598fa452f709feed986324ed6e890a53c"}
{"level":"info","ts":"2026-07-14T14:39:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/69e78be2d9d1ab531b397f50660ffb24b1f2f801b09b2a395900d6ad33c93637"}
{"level":"info","ts":"2026-07-14T14:39:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d5e6ad9d490dcd8e3b4714a7c9829a582e9edb0797cea46a0185730a61c91926"}
{"level":"info","ts":"2026-07-14T14:39:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f7d92603951bc6119d9e1233229e97d3c15bcb6f7db0be4f444c3d3cb3f64352"}
{"level":"info","ts":"2026-07-14T14:39:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/aebe9498561ca5332e1efcca81a096844e528a75c11ec9d91884e299b69c55a4"}
{"level":"info","ts":"2026-07-14T14:39:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/875e872ba3c852be3df6294ca1aab4844f2bfa0fa12420654a36470557312af7"}
{"level":"info","ts":"2026-07-14T14:39:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b3245d498ac2c215b65e99d27a099fc323fd23abe19a99a7fd7b78c609de3021"}
{"level":"info","ts":"2026-07-14T14:39:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/325fd5a45bf0c37746cc0bfb6580db2576ee085318bcb3171807f975c1cfadc5"}
{"level":"info","ts":"2026-07-14T14:39:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/73e69c2455ce4b899cd25e18692117bb537a9e9a263492536ea7472aa5fdaa91"}
{"level":"info","ts":"2026-07-14T14:39:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2cb15ddc2b3fc6c7229894a41fc72a84c27c3b1ca44fffa81999c75f7ec6df22"}
{"level":"info","ts":"2026-07-14T14:39:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/97d8a986a1f36d2c9d70faf8c55b45141fe691f273f965b26dd7a504a75780e9"}
{"level":"info","ts":"2026-07-14T14:39:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b5d08e5139f05f6d4b25a9b21ae064aec2f09faa39df56fb27bdae83a7eab912"}
{"level":"info","ts":"2026-07-14T14:39:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/cd1a96843ac3d23be05a951e39360eb168c2ecf8f8b1a03e23fa8a299bc64354"}
{"level":"info","ts":"2026-07-14T14:39:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/bbdbd5aa1b919985e447ece3303413dc26151acf3f244b3462b6ea862b3d3968"}
{"level":"info","ts":"2026-07-14T14:39:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e68fac53ae40530cec2caddb661a9b0b07da0699ec15d6c461ca602d92af4943"}
{"level":"info","ts":"2026-07-14T14:40:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ca5c3e93e7ad2e57d078282c6991a368fc2db7efbcfcac6f212ff88b9dbb689c"}
{"level":"info","ts":"2026-07-14T14:40:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c8cd1ff4f774d2a5f11d2209a21ae29adeb83c047d4f478bfd78f604725f8ec4"}
{"level":"info","ts":"2026-07-14T14:40:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/95f215820b0caa307c8e4aa64730562f3168e38c696151615873203a0390d66a"}
{"level":"info","ts":"2026-07-14T14:40:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/971824d4c761c1f804e7d36b3c0330e565476ba6494a980c11ac326ac06fb364"}