{"level":"debug","ts":"2026-07-24T02:14:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0b4d4f54-64d8-4745-ae8c-3d557286a8fd","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T02:14:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0b4d4f54-64d8-4745-ae8c-3d557286a8fd","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-6bcabd/rate-test-model-6bcabd\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-6bcabd/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T02:14:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0b4d4f54-64d8-4745-ae8c-3d557286a8fd","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T02:14:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0b4d4f54-64d8-4745-ae8c-3d557286a8fd","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T02:14:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0b4d4f54-64d8-4745-ae8c-3d557286a8fd","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T02:14:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0b4d4f54-64d8-4745-ae8c-3d557286a8fd","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-68c60f"}
{"level":"debug","ts":"2026-07-24T02:14:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0b4d4f54-64d8-4745-ae8c-3d557286a8fd","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"936c3ca6-df36-4063-b7b5-74aba6dc48e9","keyName":"e2e-rate-a-68c60f","selected_subscription":"e2e-rate-iso-a-68c60f","selected_subscription_key":"ai-tenant-e2e-shared-a-6bcabd/e2e-rate-iso-a-68c60f@ai-tenant-e2e-shared-a-6bcabd/rate-test-model-6bcabd","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-6bcabd","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-68c60f","namespace":"ai-tenant-e2e-shared-a-6bcabd","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-6bcabd/rate-test-model-6bcabd"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T02:14:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0b4d4f54-64d8-4745-ae8c-3d557286a8fd","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T02:14:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0b4d4f54-64d8-4745-ae8c-3d557286a8fd","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T02:14:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9a83fd5e-0d35-45e0-b0ff-f2fe77e5a016","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:52912","PortSpecifier":{"PortValue":52912}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.81:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9a83fd5e-0d35-45e0-b0ff-f2fe77e5a016","method":"POST","path":"/ai-tenant-e2e-shared-a-6bcabd/rate-test-model-6bcabd/v1/completions","host":"e2e-shared-a-6bcabd.apps.3cc369e0-6f69-4650-90d5-28c99b380518.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T02:14:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9a83fd5e-0d35-45e0-b0ff-f2fe77e5a016","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:52912","PortSpecifier":{"PortValue":52912}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.81:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784859290,"nanos":56396603},"http":{"id":"9a83fd5e-0d35-45e0-b0ff-f2fe77e5a016","method":"POST","headers":{":authority":"e2e-shared-a-6bcabd.apps.3cc369e0-6f69-4650-90d5-28c99b380518.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-6bcabd/rate-test-model-6bcabd/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T02:14:50Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9a83fd5e-0d35-45e0-b0ff-f2fe77e5a016","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-QLZNE2xbtQgQ8K1V_bnLEGUQsKXlngGKmRLTWPNJcQPL7xT9QrbhXPUdo7LH"}
{"level":"debug","ts":"2026-07-24T02:14:50Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9a83fd5e-0d35-45e0-b0ff-f2fe77e5a016","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-6bcabd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-QLZNE2xbtQgQ8K1V_bnLEGUQsKXlngGKmRLTWPNJcQPL7xT9QrbhXPUdo7LH\"}"}
{"level":"debug","ts":"2026-07-24T02:14:50Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9a83fd5e-0d35-45e0-b0ff-f2fe77e5a016","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-6bcabd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"936c3ca6-df36-4063-b7b5-74aba6dc48e9","keyName":"e2e-rate-a-68c60f","subscription":"e2e-rate-iso-a-68c60f","tenant":"e2e-shared-a-6bcabd","userId":"936c3ca6-df36-4063-b7b5-74aba6dc48e9","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T02:14:50Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9a83fd5e-0d35-45e0-b0ff-f2fe77e5a016","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-6bcabd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-6bcabd/rate-test-model-6bcabd\",\"requestedSubscription\":\"e2e-rate-iso-a-68c60f\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T02:14:50Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9a83fd5e-0d35-45e0-b0ff-f2fe77e5a016","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-6bcabd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-6bcabd","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-68c60f","namespace":"ai-tenant-e2e-shared-a-6bcabd","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-6bcabd/rate-test-model-6bcabd"}}
{"level":"debug","ts":"2026-07-24T02:14:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9a83fd5e-0d35-45e0-b0ff-f2fe77e5a016","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T02:14:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9a83fd5e-0d35-45e0-b0ff-f2fe77e5a016","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T02:14:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9a83fd5e-0d35-45e0-b0ff-f2fe77e5a016","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T02:14:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9a83fd5e-0d35-45e0-b0ff-f2fe77e5a016","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-6bcabd/rate-test-model-6bcabd\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-6bcabd/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T02:14:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9a83fd5e-0d35-45e0-b0ff-f2fe77e5a016","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T02:14:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9a83fd5e-0d35-45e0-b0ff-f2fe77e5a016","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-68c60f"}
{"level":"debug","ts":"2026-07-24T02:14:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9a83fd5e-0d35-45e0-b0ff-f2fe77e5a016","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T02:14:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9a83fd5e-0d35-45e0-b0ff-f2fe77e5a016","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T02:14:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9a83fd5e-0d35-45e0-b0ff-f2fe77e5a016","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"936c3ca6-df36-4063-b7b5-74aba6dc48e9","keyName":"e2e-rate-a-68c60f","selected_subscription":"e2e-rate-iso-a-68c60f","selected_subscription_key":"ai-tenant-e2e-shared-a-6bcabd/e2e-rate-iso-a-68c60f@ai-tenant-e2e-shared-a-6bcabd/rate-test-model-6bcabd","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-6bcabd","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-68c60f","namespace":"ai-tenant-e2e-shared-a-6bcabd","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-6bcabd/rate-test-model-6bcabd"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T02:14:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9a83fd5e-0d35-45e0-b0ff-f2fe77e5a016","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T02:14:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9a83fd5e-0d35-45e0-b0ff-f2fe77e5a016","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T02:14:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e12d686b-8e29-4b6c-8fa0-d948c6c3f585","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:52918","PortSpecifier":{"PortValue":52918}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.81:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e12d686b-8e29-4b6c-8fa0-d948c6c3f585","method":"POST","path":"/ai-tenant-e2e-shared-a-6bcabd/rate-test-model-6bcabd/v1/completions","host":"e2e-shared-a-6bcabd.apps.3cc369e0-6f69-4650-90d5-28c99b380518.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T02:14:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e12d686b-8e29-4b6c-8fa0-d948c6c3f585","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:52918","PortSpecifier":{"PortValue":52918}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.81:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784859291,"nanos":98465831},"http":{"id":"e12d686b-8e29-4b6c-8fa0-d948c6c3f585","method":"POST","headers":{":authority":"e2e-shared-a-6bcabd.apps.3cc369e0-6f69-4650-90d5-28c99b380518.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-6bcabd/rate-test-model-6bcabd/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T02:14:51Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e12d686b-8e29-4b6c-8fa0-d948c6c3f585","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-QLZNE2xbtQgQ8K1V_bnLEGUQsKXlngGKmRLTWPNJcQPL7xT9QrbhXPUdo7LH"}
{"level":"debug","ts":"2026-07-24T02:14:51Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e12d686b-8e29-4b6c-8fa0-d948c6c3f585","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-6bcabd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-QLZNE2xbtQgQ8K1V_bnLEGUQsKXlngGKmRLTWPNJcQPL7xT9QrbhXPUdo7LH\"}"}
{"level":"debug","ts":"2026-07-24T02:14:51Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e12d686b-8e29-4b6c-8fa0-d948c6c3f585","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-6bcabd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"936c3ca6-df36-4063-b7b5-74aba6dc48e9","keyName":"e2e-rate-a-68c60f","subscription":"e2e-rate-iso-a-68c60f","tenant":"e2e-shared-a-6bcabd","userId":"936c3ca6-df36-4063-b7b5-74aba6dc48e9","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T02:14:51Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e12d686b-8e29-4b6c-8fa0-d948c6c3f585","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-6bcabd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-6bcabd/rate-test-model-6bcabd\",\"requestedSubscription\":\"e2e-rate-iso-a-68c60f\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T02:14:51Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e12d686b-8e29-4b6c-8fa0-d948c6c3f585","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-6bcabd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-6bcabd","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-68c60f","namespace":"ai-tenant-e2e-shared-a-6bcabd","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-6bcabd/rate-test-model-6bcabd"}}
{"level":"debug","ts":"2026-07-24T02:14:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e12d686b-8e29-4b6c-8fa0-d948c6c3f585","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T02:14:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e12d686b-8e29-4b6c-8fa0-d948c6c3f585","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T02:14:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e12d686b-8e29-4b6c-8fa0-d948c6c3f585","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T02:14:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e12d686b-8e29-4b6c-8fa0-d948c6c3f585","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T02:14:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e12d686b-8e29-4b6c-8fa0-d948c6c3f585","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-6bcabd/rate-test-model-6bcabd\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-6bcabd/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T02:14:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e12d686b-8e29-4b6c-8fa0-d948c6c3f585","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T02:14:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e12d686b-8e29-4b6c-8fa0-d948c6c3f585","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T02:14:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e12d686b-8e29-4b6c-8fa0-d948c6c3f585","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-68c60f"}
{"level":"debug","ts":"2026-07-24T02:14:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e12d686b-8e29-4b6c-8fa0-d948c6c3f585","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"936c3ca6-df36-4063-b7b5-74aba6dc48e9","keyName":"e2e-rate-a-68c60f","selected_subscription":"e2e-rate-iso-a-68c60f","selected_subscription_key":"ai-tenant-e2e-shared-a-6bcabd/e2e-rate-iso-a-68c60f@ai-tenant-e2e-shared-a-6bcabd/rate-test-model-6bcabd","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-6bcabd","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-68c60f","namespace":"ai-tenant-e2e-shared-a-6bcabd","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-6bcabd/rate-test-model-6bcabd"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T02:14:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e12d686b-8e29-4b6c-8fa0-d948c6c3f585","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T02:14:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e12d686b-8e29-4b6c-8fa0-d948c6c3f585","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T02:14:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"dc0d6943-d86b-4458-816e-52974ba3690a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:52924","PortSpecifier":{"PortValue":52924}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.81:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"dc0d6943-d86b-4458-816e-52974ba3690a","method":"POST","path":"/ai-tenant-e2e-shared-a-6bcabd/rate-test-model-6bcabd/v1/completions","host":"e2e-shared-a-6bcabd.apps.3cc369e0-6f69-4650-90d5-28c99b380518.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T02:14:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"dc0d6943-d86b-4458-816e-52974ba3690a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:52924","PortSpecifier":{"PortValue":52924}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.81:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784859292,"nanos":141520613},"http":{"id":"dc0d6943-d86b-4458-816e-52974ba3690a","method":"POST","headers":{":authority":"e2e-shared-a-6bcabd.apps.3cc369e0-6f69-4650-90d5-28c99b380518.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-6bcabd/rate-test-model-6bcabd/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T02:14:52Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"dc0d6943-d86b-4458-816e-52974ba3690a","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-QLZNE2xbtQgQ8K1V_bnLEGUQsKXlngGKmRLTWPNJcQPL7xT9QrbhXPUdo7LH"}
{"level":"debug","ts":"2026-07-24T02:14:52Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"dc0d6943-d86b-4458-816e-52974ba3690a","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-6bcabd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-QLZNE2xbtQgQ8K1V_bnLEGUQsKXlngGKmRLTWPNJcQPL7xT9QrbhXPUdo7LH\"}"}
{"level":"debug","ts":"2026-07-24T02:14:52Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"dc0d6943-d86b-4458-816e-52974ba3690a","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-6bcabd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"936c3ca6-df36-4063-b7b5-74aba6dc48e9","keyName":"e2e-rate-a-68c60f","subscription":"e2e-rate-iso-a-68c60f","tenant":"e2e-shared-a-6bcabd","userId":"936c3ca6-df36-4063-b7b5-74aba6dc48e9","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T02:14:52Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"dc0d6943-d86b-4458-816e-52974ba3690a","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-6bcabd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-6bcabd/rate-test-model-6bcabd\",\"requestedSubscription\":\"e2e-rate-iso-a-68c60f\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T02:14:52Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"dc0d6943-d86b-4458-816e-52974ba3690a","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-6bcabd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-6bcabd","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-68c60f","namespace":"ai-tenant-e2e-shared-a-6bcabd","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-6bcabd/rate-test-model-6bcabd"}}
{"level":"debug","ts":"2026-07-24T02:14:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"dc0d6943-d86b-4458-816e-52974ba3690a","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T02:14:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dc0d6943-d86b-4458-816e-52974ba3690a","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T02:14:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dc0d6943-d86b-4458-816e-52974ba3690a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T02:14:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dc0d6943-d86b-4458-816e-52974ba3690a","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-6bcabd/rate-test-model-6bcabd\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-6bcabd/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T02:14:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dc0d6943-d86b-4458-816e-52974ba3690a","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T02:14:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dc0d6943-d86b-4458-816e-52974ba3690a","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T02:14:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dc0d6943-d86b-4458-816e-52974ba3690a","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-68c60f"}
{"level":"debug","ts":"2026-07-24T02:14:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dc0d6943-d86b-4458-816e-52974ba3690a","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T02:14:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dc0d6943-d86b-4458-816e-52974ba3690a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"936c3ca6-df36-4063-b7b5-74aba6dc48e9","keyName":"e2e-rate-a-68c60f","selected_subscription":"e2e-rate-iso-a-68c60f","selected_subscription_key":"ai-tenant-e2e-shared-a-6bcabd/e2e-rate-iso-a-68c60f@ai-tenant-e2e-shared-a-6bcabd/rate-test-model-6bcabd","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-6bcabd","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-68c60f","namespace":"ai-tenant-e2e-shared-a-6bcabd","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-6bcabd/rate-test-model-6bcabd"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T02:14:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"dc0d6943-d86b-4458-816e-52974ba3690a","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T02:14:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"dc0d6943-d86b-4458-816e-52974ba3690a","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T02:14:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b8a91a76-bed2-422b-978e-848377f6867a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:52928","PortSpecifier":{"PortValue":52928}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.81:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b8a91a76-bed2-422b-978e-848377f6867a","method":"POST","path":"/ai-tenant-e2e-shared-a-6bcabd/rate-test-model-6bcabd/v1/completions","host":"e2e-shared-a-6bcabd.apps.3cc369e0-6f69-4650-90d5-28c99b380518.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T02:14:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b8a91a76-bed2-422b-978e-848377f6867a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:52928","PortSpecifier":{"PortValue":52928}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.81:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784859293,"nanos":181631238},"http":{"id":"b8a91a76-bed2-422b-978e-848377f6867a","method":"POST","headers":{":authority":"e2e-shared-a-6bcabd.apps.3cc369e0-6f69-4650-90d5-28c99b380518.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-6bcabd/rate-test-model-6bcabd/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T02:14:53Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b8a91a76-bed2-422b-978e-848377f6867a","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-QLZNE2xbtQgQ8K1V_bnLEGUQsKXlngGKmRLTWPNJcQPL7xT9QrbhXPUdo7LH"}
{"level":"debug","ts":"2026-07-24T02:14:53Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b8a91a76-bed2-422b-978e-848377f6867a","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-6bcabd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-QLZNE2xbtQgQ8K1V_bnLEGUQsKXlngGKmRLTWPNJcQPL7xT9QrbhXPUdo7LH\"}"}
{"level":"debug","ts":"2026-07-24T02:14:53Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b8a91a76-bed2-422b-978e-848377f6867a","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-6bcabd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"936c3ca6-df36-4063-b7b5-74aba6dc48e9","keyName":"e2e-rate-a-68c60f","subscription":"e2e-rate-iso-a-68c60f","tenant":"e2e-shared-a-6bcabd","userId":"936c3ca6-df36-4063-b7b5-74aba6dc48e9","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T02:14:53Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b8a91a76-bed2-422b-978e-848377f6867a","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-6bcabd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-6bcabd/rate-test-model-6bcabd\",\"requestedSubscription\":\"e2e-rate-iso-a-68c60f\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T02:14:53Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b8a91a76-bed2-422b-978e-848377f6867a","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-6bcabd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-6bcabd","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-68c60f","namespace":"ai-tenant-e2e-shared-a-6bcabd","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-6bcabd/rate-test-model-6bcabd"}}
{"level":"debug","ts":"2026-07-24T02:14:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b8a91a76-bed2-422b-978e-848377f6867a","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T02:14:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b8a91a76-bed2-422b-978e-848377f6867a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T02:14:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b8a91a76-bed2-422b-978e-848377f6867a","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T02:14:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b8a91a76-bed2-422b-978e-848377f6867a","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T02:14:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b8a91a76-bed2-422b-978e-848377f6867a","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-6bcabd/rate-test-model-6bcabd\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-6bcabd/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T02:14:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b8a91a76-bed2-422b-978e-848377f6867a","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T02:14:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b8a91a76-bed2-422b-978e-848377f6867a","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-68c60f"}
{"level":"debug","ts":"2026-07-24T02:14:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b8a91a76-bed2-422b-978e-848377f6867a","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T02:14:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b8a91a76-bed2-422b-978e-848377f6867a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"936c3ca6-df36-4063-b7b5-74aba6dc48e9","keyName":"e2e-rate-a-68c60f","selected_subscription":"e2e-rate-iso-a-68c60f","selected_subscription_key":"ai-tenant-e2e-shared-a-6bcabd/e2e-rate-iso-a-68c60f@ai-tenant-e2e-shared-a-6bcabd/rate-test-model-6bcabd","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-6bcabd","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-68c60f","namespace":"ai-tenant-e2e-shared-a-6bcabd","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-6bcabd/rate-test-model-6bcabd"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T02:14:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b8a91a76-bed2-422b-978e-848377f6867a","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T02:14:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b8a91a76-bed2-422b-978e-848377f6867a","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T02:15:01Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5c934b6e-4f72-42b4-8cfa-6d7d39c2b091","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:43568","PortSpecifier":{"PortValue":43568}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.81:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5c934b6e-4f72-42b4-8cfa-6d7d39c2b091","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-6bcabd.apps.3cc369e0-6f69-4650-90d5-28c99b380518.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T02:15:01Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5c934b6e-4f72-42b4-8cfa-6d7d39c2b091","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:43568","PortSpecifier":{"PortValue":43568}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.81:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784859301,"nanos":963678929},"http":{"id":"5c934b6e-4f72-42b4-8cfa-6d7d39c2b091","method":"POST","headers":{":authority":"e2e-shared-a-6bcabd.apps.3cc369e0-6f69-4650-90d5-28c99b380518.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T02:15:01Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"5c934b6e-4f72-42b4-8cfa-6d7d39c2b091","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-24T02:15:01Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5c934b6e-4f72-42b4-8cfa-6d7d39c2b091","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"f29f66c2-a19e-4465-a7c7-78c9c558bf70","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=418f119d-8728-4d81-ae00-6c04fed31bc9"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/28c99b380518"]}}
{"level":"debug","ts":"2026-07-24T02:15:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5c934b6e-4f72-42b4-8cfa-6d7d39c2b091","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/28c99b380518"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=418f119d-8728-4d81-ae00-6c04fed31bc9"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"f29f66c2-a19e-4465-a7c7-78c9c558bf70","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"69a983cbe0fdee8993f347b0025e355a2839922c5c626600fc22ab314a0ba716"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.81:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-6bcabd.apps.3cc369e0-6f69-4650-90d5-28c99b380518.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T02:15:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5c934b6e-4f72-42b4-8cfa-6d7d39c2b091","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T02:15:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5c934b6e-4f72-42b4-8cfa-6d7d39c2b091","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T02:15:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5c934b6e-4f72-42b4-8cfa-6d7d39c2b091","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-6bcabd/rate-test-model-6bcabd\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-6bcabd/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T02:15:01Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"5c934b6e-4f72-42b4-8cfa-6d7d39c2b091","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-24T02:15:01Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5c934b6e-4f72-42b4-8cfa-6d7d39c2b091","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T02:15:01Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5c934b6e-4f72-42b4-8cfa-6d7d39c2b091","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-24T02:15:01Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5c934b6e-4f72-42b4-8cfa-6d7d39c2b091","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T02:15:01Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5c934b6e-4f72-42b4-8cfa-6d7d39c2b091","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T02:15:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f6d5c048-324c-4054-8cde-96b7c15e85f3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:44710","PortSpecifier":{"PortValue":44710}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.56:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f6d5c048-324c-4054-8cde-96b7c15e85f3","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-a7fbc1.apps.3cc369e0-6f69-4650-90d5-28c99b380518.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T02:15:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f6d5c048-324c-4054-8cde-96b7c15e85f3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:44710","PortSpecifier":{"PortValue":44710}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.56:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784859302,"nanos":1482838},"http":{"id":"f6d5c048-324c-4054-8cde-96b7c15e85f3","method":"POST","headers":{":authority":"e2e-shared-b-a7fbc1.apps.3cc369e0-6f69-4650-90d5-28c99b380518.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T02:15:02Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"f6d5c048-324c-4054-8cde-96b7c15e85f3","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-24T02:15:02Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f6d5c048-324c-4054-8cde-96b7c15e85f3","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"f29f66c2-a19e-4465-a7c7-78c9c558bf70","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=418f119d-8728-4d81-ae00-6c04fed31bc9"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/28c99b380518"]}}
{"level":"debug","ts":"2026-07-24T02:15:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f6d5c048-324c-4054-8cde-96b7c15e85f3","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/28c99b380518"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=418f119d-8728-4d81-ae00-6c04fed31bc9"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"f29f66c2-a19e-4465-a7c7-78c9c558bf70","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"321389ba0ff5573bd0fc2d44d95650dcae7942471e0dfe94e3843ddd6b0ee439"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.56:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-a7fbc1.apps.3cc369e0-6f69-4650-90d5-28c99b380518.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T02:15:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f6d5c048-324c-4054-8cde-96b7c15e85f3","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T02:15:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f6d5c048-324c-4054-8cde-96b7c15e85f3","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T02:15:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f6d5c048-324c-4054-8cde-96b7c15e85f3","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-a7fbc1/rate-test-model-a7fbc1\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-a7fbc1/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T02:15:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"f6d5c048-324c-4054-8cde-96b7c15e85f3","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-24T02:15:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f6d5c048-324c-4054-8cde-96b7c15e85f3","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T02:15:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f6d5c048-324c-4054-8cde-96b7c15e85f3","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-24T02:15:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f6d5c048-324c-4054-8cde-96b7c15e85f3","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T02:15:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f6d5c048-324c-4054-8cde-96b7c15e85f3","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T02:15:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f6b5c73e-7d11-4849-b676-355f9b1752fc","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:43572","PortSpecifier":{"PortValue":43572}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.81:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f6b5c73e-7d11-4849-b676-355f9b1752fc","method":"POST","path":"/ai-tenant-e2e-shared-a-6bcabd/rate-test-model-6bcabd/v1/completions","host":"e2e-shared-a-6bcabd.apps.3cc369e0-6f69-4650-90d5-28c99b380518.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T02:15:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f6b5c73e-7d11-4849-b676-355f9b1752fc","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:43572","PortSpecifier":{"PortValue":43572}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.81:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784859302,"nanos":42752068},"http":{"id":"f6b5c73e-7d11-4849-b676-355f9b1752fc","method":"POST","headers":{":authority":"e2e-shared-a-6bcabd.apps.3cc369e0-6f69-4650-90d5-28c99b380518.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-6bcabd/rate-test-model-6bcabd/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T02:15:02Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f6b5c73e-7d11-4849-b676-355f9b1752fc","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-JyMyay0Q6gyxQzgh_bbLnArUWiiVNW4TXuO86Z72xCMgT9zkiCdx1KdtYuqO"}
{"level":"debug","ts":"2026-07-24T02:15:02Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f6b5c73e-7d11-4849-b676-355f9b1752fc","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-6bcabd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-JyMyay0Q6gyxQzgh_bbLnArUWiiVNW4TXuO86Z72xCMgT9zkiCdx1KdtYuqO\"}"}
{"level":"debug","ts":"2026-07-24T02:15:02Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f6b5c73e-7d11-4849-b676-355f9b1752fc","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-6bcabd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"d053093a-1fa4-44ca-b239-afa682f2881b","keyName":"e2e-rate-a-d3962f","subscription":"e2e-rate-iso-a-d3962f","tenant":"e2e-shared-a-6bcabd","userId":"d053093a-1fa4-44ca-b239-afa682f2881b","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T02:15:02Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f6b5c73e-7d11-4849-b676-355f9b1752fc","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-6bcabd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-6bcabd/rate-test-model-6bcabd\",\"requestedSubscription\":\"e2e-rate-iso-a-d3962f\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T02:15:02Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f6b5c73e-7d11-4849-b676-355f9b1752fc","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-6bcabd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-6bcabd","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d3962f","namespace":"ai-tenant-e2e-shared-a-6bcabd","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-6bcabd/rate-test-model-6bcabd"}}
{"level":"debug","ts":"2026-07-24T02:15:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f6b5c73e-7d11-4849-b676-355f9b1752fc","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T02:15:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f6b5c73e-7d11-4849-b676-355f9b1752fc","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T02:15:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f6b5c73e-7d11-4849-b676-355f9b1752fc","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T02:15:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f6b5c73e-7d11-4849-b676-355f9b1752fc","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T02:15:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f6b5c73e-7d11-4849-b676-355f9b1752fc","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-6bcabd/rate-test-model-6bcabd\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-6bcabd/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T02:15:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f6b5c73e-7d11-4849-b676-355f9b1752fc","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T02:15:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f6b5c73e-7d11-4849-b676-355f9b1752fc","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-d3962f"}
{"level":"debug","ts":"2026-07-24T02:15:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f6b5c73e-7d11-4849-b676-355f9b1752fc","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T02:15:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f6b5c73e-7d11-4849-b676-355f9b1752fc","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"d053093a-1fa4-44ca-b239-afa682f2881b","keyName":"e2e-rate-a-d3962f","selected_subscription":"e2e-rate-iso-a-d3962f","selected_subscription_key":"ai-tenant-e2e-shared-a-6bcabd/e2e-rate-iso-a-d3962f@ai-tenant-e2e-shared-a-6bcabd/rate-test-model-6bcabd","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-6bcabd","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d3962f","namespace":"ai-tenant-e2e-shared-a-6bcabd","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-6bcabd/rate-test-model-6bcabd"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T02:15:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f6b5c73e-7d11-4849-b676-355f9b1752fc","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T02:15:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f6b5c73e-7d11-4849-b676-355f9b1752fc","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T02:15:03Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3c638adc-1499-45db-b47c-ca38018d0a53","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:43586","PortSpecifier":{"PortValue":43586}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.81:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3c638adc-1499-45db-b47c-ca38018d0a53","method":"POST","path":"/ai-tenant-e2e-shared-a-6bcabd/rate-test-model-6bcabd/v1/completions","host":"e2e-shared-a-6bcabd.apps.3cc369e0-6f69-4650-90d5-28c99b380518.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T02:15:03Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3c638adc-1499-45db-b47c-ca38018d0a53","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:43586","PortSpecifier":{"PortValue":43586}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.81:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784859303,"nanos":85060942},"http":{"id":"3c638adc-1499-45db-b47c-ca38018d0a53","method":"POST","headers":{":authority":"e2e-shared-a-6bcabd.apps.3cc369e0-6f69-4650-90d5-28c99b380518.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-6bcabd/rate-test-model-6bcabd/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T02:15:03Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3c638adc-1499-45db-b47c-ca38018d0a53","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-JyMyay0Q6gyxQzgh_bbLnArUWiiVNW4TXuO86Z72xCMgT9zkiCdx1KdtYuqO"}
{"level":"debug","ts":"2026-07-24T02:15:03Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3c638adc-1499-45db-b47c-ca38018d0a53","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-6bcabd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-JyMyay0Q6gyxQzgh_bbLnArUWiiVNW4TXuO86Z72xCMgT9zkiCdx1KdtYuqO\"}"}
{"level":"debug","ts":"2026-07-24T02:15:03Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3c638adc-1499-45db-b47c-ca38018d0a53","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-6bcabd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"d053093a-1fa4-44ca-b239-afa682f2881b","keyName":"e2e-rate-a-d3962f","subscription":"e2e-rate-iso-a-d3962f","tenant":"e2e-shared-a-6bcabd","userId":"d053093a-1fa4-44ca-b239-afa682f2881b","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T02:15:03Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3c638adc-1499-45db-b47c-ca38018d0a53","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-6bcabd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-6bcabd/rate-test-model-6bcabd\",\"requestedSubscription\":\"e2e-rate-iso-a-d3962f\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T02:15:03Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3c638adc-1499-45db-b47c-ca38018d0a53","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-6bcabd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-6bcabd","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d3962f","namespace":"ai-tenant-e2e-shared-a-6bcabd","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-6bcabd/rate-test-model-6bcabd"}}
{"level":"debug","ts":"2026-07-24T02:15:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3c638adc-1499-45db-b47c-ca38018d0a53","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T02:15:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3c638adc-1499-45db-b47c-ca38018d0a53","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T02:15:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3c638adc-1499-45db-b47c-ca38018d0a53","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T02:15:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3c638adc-1499-45db-b47c-ca38018d0a53","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-6bcabd/rate-test-model-6bcabd\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-6bcabd/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T02:15:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3c638adc-1499-45db-b47c-ca38018d0a53","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T02:15:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3c638adc-1499-45db-b47c-ca38018d0a53","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T02:15:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3c638adc-1499-45db-b47c-ca38018d0a53","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-d3962f"}
{"level":"debug","ts":"2026-07-24T02:15:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3c638adc-1499-45db-b47c-ca38018d0a53","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T02:15:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3c638adc-1499-45db-b47c-ca38018d0a53","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"d053093a-1fa4-44ca-b239-afa682f2881b","keyName":"e2e-rate-a-d3962f","selected_subscription":"e2e-rate-iso-a-d3962f","selected_subscription_key":"ai-tenant-e2e-shared-a-6bcabd/e2e-rate-iso-a-d3962f@ai-tenant-e2e-shared-a-6bcabd/rate-test-model-6bcabd","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-6bcabd","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d3962f","namespace":"ai-tenant-e2e-shared-a-6bcabd","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-6bcabd/rate-test-model-6bcabd"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T02:15:03Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3c638adc-1499-45db-b47c-ca38018d0a53","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T02:15:03Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3c638adc-1499-45db-b47c-ca38018d0a53","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T02:15:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5ca910ad-ba44-46d8-ac5a-e0d761a433ce","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:43592","PortSpecifier":{"PortValue":43592}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.81:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5ca910ad-ba44-46d8-ac5a-e0d761a433ce","method":"POST","path":"/ai-tenant-e2e-shared-a-6bcabd/rate-test-model-6bcabd/v1/completions","host":"e2e-shared-a-6bcabd.apps.3cc369e0-6f69-4650-90d5-28c99b380518.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T02:15:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5ca910ad-ba44-46d8-ac5a-e0d761a433ce","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:43592","PortSpecifier":{"PortValue":43592}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.81:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784859304,"nanos":128883219},"http":{"id":"5ca910ad-ba44-46d8-ac5a-e0d761a433ce","method":"POST","headers":{":authority":"e2e-shared-a-6bcabd.apps.3cc369e0-6f69-4650-90d5-28c99b380518.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-6bcabd/rate-test-model-6bcabd/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T02:15:04Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5ca910ad-ba44-46d8-ac5a-e0d761a433ce","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-JyMyay0Q6gyxQzgh_bbLnArUWiiVNW4TXuO86Z72xCMgT9zkiCdx1KdtYuqO"}
{"level":"debug","ts":"2026-07-24T02:15:04Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5ca910ad-ba44-46d8-ac5a-e0d761a433ce","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-6bcabd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-JyMyay0Q6gyxQzgh_bbLnArUWiiVNW4TXuO86Z72xCMgT9zkiCdx1KdtYuqO\"}"}
{"level":"debug","ts":"2026-07-24T02:15:04Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5ca910ad-ba44-46d8-ac5a-e0d761a433ce","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-6bcabd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"d053093a-1fa4-44ca-b239-afa682f2881b","keyName":"e2e-rate-a-d3962f","subscription":"e2e-rate-iso-a-d3962f","tenant":"e2e-shared-a-6bcabd","userId":"d053093a-1fa4-44ca-b239-afa682f2881b","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T02:15:04Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5ca910ad-ba44-46d8-ac5a-e0d761a433ce","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-6bcabd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-6bcabd/rate-test-model-6bcabd\",\"requestedSubscription\":\"e2e-rate-iso-a-d3962f\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T02:15:04Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5ca910ad-ba44-46d8-ac5a-e0d761a433ce","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-6bcabd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-6bcabd","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d3962f","namespace":"ai-tenant-e2e-shared-a-6bcabd","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-6bcabd/rate-test-model-6bcabd"}}
{"level":"debug","ts":"2026-07-24T02:15:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5ca910ad-ba44-46d8-ac5a-e0d761a433ce","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T02:15:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5ca910ad-ba44-46d8-ac5a-e0d761a433ce","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T02:15:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5ca910ad-ba44-46d8-ac5a-e0d761a433ce","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T02:15:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5ca910ad-ba44-46d8-ac5a-e0d761a433ce","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T02:15:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5ca910ad-ba44-46d8-ac5a-e0d761a433ce","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-6bcabd/rate-test-model-6bcabd\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-6bcabd/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T02:15:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5ca910ad-ba44-46d8-ac5a-e0d761a433ce","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T02:15:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5ca910ad-ba44-46d8-ac5a-e0d761a433ce","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-d3962f"}
{"level":"debug","ts":"2026-07-24T02:15:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5ca910ad-ba44-46d8-ac5a-e0d761a433ce","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T02:15:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5ca910ad-ba44-46d8-ac5a-e0d761a433ce","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"d053093a-1fa4-44ca-b239-afa682f2881b","keyName":"e2e-rate-a-d3962f","selected_subscription":"e2e-rate-iso-a-d3962f","selected_subscription_key":"ai-tenant-e2e-shared-a-6bcabd/e2e-rate-iso-a-d3962f@ai-tenant-e2e-shared-a-6bcabd/rate-test-model-6bcabd","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-6bcabd","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d3962f","namespace":"ai-tenant-e2e-shared-a-6bcabd","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-6bcabd/rate-test-model-6bcabd"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T02:15:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5ca910ad-ba44-46d8-ac5a-e0d761a433ce","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T02:15:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5ca910ad-ba44-46d8-ac5a-e0d761a433ce","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T02:15:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4a7d1144-bae1-4631-b445-68b35d9a1516","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:44716","PortSpecifier":{"PortValue":44716}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.56:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"4a7d1144-bae1-4631-b445-68b35d9a1516","method":"POST","path":"/ai-tenant-e2e-shared-b-a7fbc1/rate-test-model-a7fbc1/v1/completions","host":"e2e-shared-b-a7fbc1.apps.3cc369e0-6f69-4650-90d5-28c99b380518.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T02:15:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4a7d1144-bae1-4631-b445-68b35d9a1516","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:44716","PortSpecifier":{"PortValue":44716}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.56:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784859304,"nanos":167145999},"http":{"id":"4a7d1144-bae1-4631-b445-68b35d9a1516","method":"POST","headers":{":authority":"e2e-shared-b-a7fbc1.apps.3cc369e0-6f69-4650-90d5-28c99b380518.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-a7fbc1/rate-test-model-a7fbc1/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T02:15:04Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"4a7d1144-bae1-4631-b445-68b35d9a1516","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-109rTQi7SxYnq32eP_KnnJ4M79Xb9fIyg8km3Fvtl0PpXDVFTRO9ykZEquifd"}
{"level":"debug","ts":"2026-07-24T02:15:04Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"4a7d1144-bae1-4631-b445-68b35d9a1516","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-a7fbc1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-109rTQi7SxYnq32eP_KnnJ4M79Xb9fIyg8km3Fvtl0PpXDVFTRO9ykZEquifd\"}"}
{"level":"debug","ts":"2026-07-24T02:15:04Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"4a7d1144-bae1-4631-b445-68b35d9a1516","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-a7fbc1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"a2a7f785-ff26-4526-abcd-3adcada1a2af","keyName":"e2e-rate-b-d3962f","subscription":"e2e-rate-iso-b-d3962f","tenant":"e2e-shared-b-a7fbc1","userId":"a2a7f785-ff26-4526-abcd-3adcada1a2af","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T02:15:04Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"4a7d1144-bae1-4631-b445-68b35d9a1516","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-a7fbc1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-a7fbc1/rate-test-model-a7fbc1\",\"requestedSubscription\":\"e2e-rate-iso-b-d3962f\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T02:15:04Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"4a7d1144-bae1-4631-b445-68b35d9a1516","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-a7fbc1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-a7fbc1","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-d3962f","namespace":"ai-tenant-e2e-shared-b-a7fbc1","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-b-a7fbc1/rate-test-model-a7fbc1"}}
{"level":"debug","ts":"2026-07-24T02:15:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"4a7d1144-bae1-4631-b445-68b35d9a1516","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T02:15:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4a7d1144-bae1-4631-b445-68b35d9a1516","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T02:15:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4a7d1144-bae1-4631-b445-68b35d9a1516","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T02:15:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4a7d1144-bae1-4631-b445-68b35d9a1516","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-a7fbc1/rate-test-model-a7fbc1\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-a7fbc1/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T02:15:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4a7d1144-bae1-4631-b445-68b35d9a1516","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T02:15:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4a7d1144-bae1-4631-b445-68b35d9a1516","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T02:15:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4a7d1144-bae1-4631-b445-68b35d9a1516","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-d3962f"}
{"level":"debug","ts":"2026-07-24T02:15:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4a7d1144-bae1-4631-b445-68b35d9a1516","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T02:15:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4a7d1144-bae1-4631-b445-68b35d9a1516","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"a2a7f785-ff26-4526-abcd-3adcada1a2af","keyName":"e2e-rate-b-d3962f","selected_subscription":"e2e-rate-iso-b-d3962f","selected_subscription_key":"ai-tenant-e2e-shared-b-a7fbc1/e2e-rate-iso-b-d3962f@ai-tenant-e2e-shared-b-a7fbc1/rate-test-model-a7fbc1","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-a7fbc1","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-d3962f","namespace":"ai-tenant-e2e-shared-b-a7fbc1","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-b-a7fbc1/rate-test-model-a7fbc1"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T02:15:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4a7d1144-bae1-4631-b445-68b35d9a1516","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T02:15:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4a7d1144-bae1-4631-b445-68b35d9a1516","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T02:15:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3da69b42147de505eb68ea43d98a87c89340fa898c378074a99673fdfdbd6c55"}
{"level":"info","ts":"2026-07-24T02:15:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7b83cbae08bdbcbbb874b2ede49d32b5ccc3b192d828ac034dd3539ea5255463"}
{"level":"info","ts":"2026-07-24T02:15:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f059db7b7961090e5a7a755c23541941e4decfb4dd64198599ea1b68ec3b91fe"}
{"level":"info","ts":"2026-07-24T02:15:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/85cf374d945ad05dcc51b429f1597475d0bdace0f5d6a245e87f811aad3fcece"}
{"level":"info","ts":"2026-07-24T02:15:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3dc323c5b44a1e8a82da61f68dba06066f4ecd9fbc98dbc0c9adcc2783ddaba7"}
{"level":"info","ts":"2026-07-24T02:15:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/0d49d190e05be9e56acf4b1eb4075428d2b79866ceb86b4a75decdd107408a3a"}
{"level":"info","ts":"2026-07-24T02:15:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/266100e6de0039088577080c6ab8a74fee7ace20e7ad479eeef5551f36b5c8de"}
{"level":"info","ts":"2026-07-24T02:15:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/5a09813395a14c00ce1952172946cc99b21644a206b697ad2a3632ef5158a248"}
{"level":"info","ts":"2026-07-24T02:15:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ca081a27daab9f175f355fc80d0b19a93f51f455c82fe61449712be3c2a05928"}
{"level":"info","ts":"2026-07-24T02:15:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7924e76d412cfc214ead4267ed861d2b82394aed615a07ed6e230f78e7aecf34"}
{"level":"info","ts":"2026-07-24T02:15:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/315d74e20053f94effd1ddd98d3ca17a0f13c522acd1898de1743e7d6a6f6bb8"}
{"level":"info","ts":"2026-07-24T02:15:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/236ab9b6777e905a0e0ec01a67b3da891d33e97c7a18b67f2742380587accb74"}
{"level":"info","ts":"2026-07-24T02:15:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d479c81eaeec15eaa672a83964a8bc9092b0c700fbfe3518486c1d3f6722b989"}
{"level":"info","ts":"2026-07-24T02:15:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/95317ea88f37bab475b3f6abc6ef549fa4ed0aca11b55881e62eead07cd7e3e0"}
{"level":"info","ts":"2026-07-24T02:15:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d6a464e7334f92dbb79e29b187ef30327b870cdba2737a15d5f6de405c52eea3"}
{"level":"info","ts":"2026-07-24T02:15:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/236ab11e1218449d5d8d83205a41378869f9c7d889257a56b4546756e56c1d70"}
{"level":"info","ts":"2026-07-24T02:15:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a497d9aaf9a98d74c42a8366972949d7bd8752222f171d9d0cf5cf2adfe27694"}
{"level":"info","ts":"2026-07-24T02:15:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/69a983cbe0fdee8993f347b0025e355a2839922c5c626600fc22ab314a0ba716"}
{"level":"info","ts":"2026-07-24T02:15:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7c0efdd4f2dbb18ab05a600dd5a2317e209d965ca9eea5b4955448a2b1f95b9d"}
{"level":"info","ts":"2026-07-24T02:15:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/dbac35b678a5c2d7abf7f337ce0ffdf53e300fb6e239381ef9306695146dcd66"}
{"level":"info","ts":"2026-07-24T02:15:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7b06af06cb73ec2bd054772bfb03047263e4861b522cd73655f10ed86672aa38"}
{"level":"info","ts":"2026-07-24T02:15:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/600882e7a4e21d1103104def24fa07ad8cf8fd753357d36d5981f1f4128fbf22"}
{"level":"info","ts":"2026-07-24T02:15:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9dbbfcf5ae41372db7dcc72a079bdd769ed55cfbce7ab520d51f2f7c067305da"}
{"level":"info","ts":"2026-07-24T02:15:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/321389ba0ff5573bd0fc2d44d95650dcae7942471e0dfe94e3843ddd6b0ee439"}
{"level":"info","ts":"2026-07-24T02:16:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"82aa3d12-d09c-4278-beac-7dea8628e3d5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:52508","PortSpecifier":{"PortValue":52508}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.43:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"82aa3d12-d09c-4278-beac-7dea8628e3d5","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.3cc369e0-6f69-4650-90d5-28c99b380518.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T02:16:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"82aa3d12-d09c-4278-beac-7dea8628e3d5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:52508","PortSpecifier":{"PortValue":52508}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.43:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784859373,"nanos":740608557},"http":{"id":"82aa3d12-d09c-4278-beac-7dea8628e3d5","method":"POST","headers":{":authority":"maas.apps.3cc369e0-6f69-4650-90d5-28c99b380518.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T02:16:13Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"82aa3d12-d09c-4278-beac-7dea8628e3d5","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-24T02:16:13Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"82aa3d12-d09c-4278-beac-7dea8628e3d5","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"f29f66c2-a19e-4465-a7c7-78c9c558bf70","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=418f119d-8728-4d81-ae00-6c04fed31bc9"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/28c99b380518"]}}
{"level":"debug","ts":"2026-07-24T02:16:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"82aa3d12-d09c-4278-beac-7dea8628e3d5","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/28c99b380518"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=418f119d-8728-4d81-ae00-6c04fed31bc9"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"f29f66c2-a19e-4465-a7c7-78c9c558bf70","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.43:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.3cc369e0-6f69-4650-90d5-28c99b380518.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T02:16:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"82aa3d12-d09c-4278-beac-7dea8628e3d5","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T02:16:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"82aa3d12-d09c-4278-beac-7dea8628e3d5","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T02:16:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"82aa3d12-d09c-4278-beac-7dea8628e3d5","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]},\"publishers/llm/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/llm/models/facebook/opt-125m-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T02:16:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"82aa3d12-d09c-4278-beac-7dea8628e3d5","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-24T02:16:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"82aa3d12-d09c-4278-beac-7dea8628e3d5","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T02:16:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"82aa3d12-d09c-4278-beac-7dea8628e3d5","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-24T02:16:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"82aa3d12-d09c-4278-beac-7dea8628e3d5","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T02:16:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"82aa3d12-d09c-4278-beac-7dea8628e3d5","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T02:16:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"71083cc0-6ddd-41ff-a40a-7064e26a2abb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:52516","PortSpecifier":{"PortValue":52516}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.43:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"71083cc0-6ddd-41ff-a40a-7064e26a2abb","method":"POST","path":"/llm/facebook-opt-125m-simulated/v1/chat/completions","host":"maas.apps.3cc369e0-6f69-4650-90d5-28c99b380518.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T02:16:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"71083cc0-6ddd-41ff-a40a-7064e26a2abb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:52516","PortSpecifier":{"PortValue":52516}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.43:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784859373,"nanos":787669368},"http":{"id":"71083cc0-6ddd-41ff-a40a-7064e26a2abb","method":"POST","headers":{":authority":"maas.apps.3cc369e0-6f69-4650-90d5-28c99b380518.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T02:16:13Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"71083cc0-6ddd-41ff-a40a-7064e26a2abb","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-2N64vbrlTzH3Twb1_F94mJhKfoH0yybd6KgR5Yjdcu4x2WC5tq1qSzgR2cQj"}
{"level":"debug","ts":"2026-07-24T02:16:13Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"71083cc0-6ddd-41ff-a40a-7064e26a2abb","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-2N64vbrlTzH3Twb1_F94mJhKfoH0yybd6KgR5Yjdcu4x2WC5tq1qSzgR2cQj\"}"}
{"level":"debug","ts":"2026-07-24T02:16:13Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"71083cc0-6ddd-41ff-a40a-7064e26a2abb","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"3a86b4d1-1fab-49d5-9546-bccd809aa33c","keyName":"e2e-ipp-default","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"3a86b4d1-1fab-49d5-9546-bccd809aa33c","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T02:16:13Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"71083cc0-6ddd-41ff-a40a-7064e26a2abb","config":"subscription-info","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"simulator-subscription\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T02:16:13Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"71083cc0-6ddd-41ff-a40a-7064e26a2abb","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true,"resolvedModel":"llm/facebook-opt-125m-simulated"}}
{"level":"debug","ts":"2026-07-24T02:16:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"71083cc0-6ddd-41ff-a40a-7064e26a2abb","input":{"auth":{"identity":"Bearer **** subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true,"resolvedModel":"llm/facebook-opt-125m-simulated"}}},"context":{"context_extensions":{"host":"311b1be286674fd5684c9ac59b318287dade9769cfe4aeebd8c88e2dc6b72418"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.43:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.3cc369e0-6f69-4650-90d5-28c99b380518.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T02:16:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"71083cc0-6ddd-41ff-a40a-7064e26a2abb","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T02:16:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"71083cc0-6ddd-41ff-a40a-7064e26a2abb","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T02:16:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"71083cc0-6ddd-41ff-a40a-7064e26a2abb","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]},\"publishers/llm/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/llm/models/facebook/opt-125m-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T02:16:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"71083cc0-6ddd-41ff-a40a-7064e26a2abb","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T02:16:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"71083cc0-6ddd-41ff-a40a-7064e26a2abb","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T02:16:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"71083cc0-6ddd-41ff-a40a-7064e26a2abb","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T02:16:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"71083cc0-6ddd-41ff-a40a-7064e26a2abb","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-24T02:16:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"71083cc0-6ddd-41ff-a40a-7064e26a2abb","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"3a86b4d1-1fab-49d5-9546-bccd809aa33c","keyName":"e2e-ipp-default","selected_subscription":"simulator-subscription","selected_subscription_key":"models-as-a-service/simulator-subscription@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true,"resolvedModel":"llm/facebook-opt-125m-simulated"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T02:16:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"71083cc0-6ddd-41ff-a40a-7064e26a2abb","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T02:16:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"71083cc0-6ddd-41ff-a40a-7064e26a2abb","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T02:16:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a278089ef5ca4f891c0b28d14073a1a0c41e87b8894b2a26b46e663890ab51a2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T02:16:44Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T02:16:44Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T02:16:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a278089ef5ca4f891c0b28d14073a1a0c41e87b8894b2a26b46e663890ab51a2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T02:16:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a278089ef5ca4f891c0b28d14073a1a0c41e87b8894b2a26b46e663890ab51a2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T02:16:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a278089ef5ca4f891c0b28d14073a1a0c41e87b8894b2a26b46e663890ab51a2","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T02:16:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a278089ef5ca4f891c0b28d14073a1a0c41e87b8894b2a26b46e663890ab51a2"}
{"level":"debug","ts":"2026-07-24T02:16:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a278089ef5ca4f891c0b28d14073a1a0c41e87b8894b2a26b46e663890ab51a2","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T02:16:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a278089ef5ca4f891c0b28d14073a1a0c41e87b8894b2a26b46e663890ab51a2"}
{"level":"debug","ts":"2026-07-24T02:16:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a278089ef5ca4f891c0b28d14073a1a0c41e87b8894b2a26b46e663890ab51a2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T02:16:44Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T02:16:44Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a278089ef5ca4f891c0b28d14073a1a0c41e87b8894b2a26b46e663890ab51a2"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T02:16:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a278089ef5ca4f891c0b28d14073a1a0c41e87b8894b2a26b46e663890ab51a2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T02:16:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a278089ef5ca4f891c0b28d14073a1a0c41e87b8894b2a26b46e663890ab51a2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T02:16:44Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T02:16:44Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T02:16:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a278089ef5ca4f891c0b28d14073a1a0c41e87b8894b2a26b46e663890ab51a2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T02:16:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a2c1b9aa96a8fed741c328d23362ee6707888520ddf1928da8674993b488d326","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T02:16:44Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T02:16:44Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T02:16:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a278089ef5ca4f891c0b28d14073a1a0c41e87b8894b2a26b46e663890ab51a2"}
{"level":"info","ts":"2026-07-24T02:16:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a2c1b9aa96a8fed741c328d23362ee6707888520ddf1928da8674993b488d326","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T02:16:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a278089ef5ca4f891c0b28d14073a1a0c41e87b8894b2a26b46e663890ab51a2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T02:16:44Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T02:16:44Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a278089ef5ca4f891c0b28d14073a1a0c41e87b8894b2a26b46e663890ab51a2"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T02:16:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a2c1b9aa96a8fed741c328d23362ee6707888520ddf1928da8674993b488d326"}
{"level":"info","ts":"2026-07-24T02:16:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a278089ef5ca4f891c0b28d14073a1a0c41e87b8894b2a26b46e663890ab51a2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T02:16:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a2c1b9aa96a8fed741c328d23362ee6707888520ddf1928da8674993b488d326","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T02:16:44Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T02:16:44Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a2c1b9aa96a8fed741c328d23362ee6707888520ddf1928da8674993b488d326"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T02:16:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a2c1b9aa96a8fed741c328d23362ee6707888520ddf1928da8674993b488d326","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T02:16:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a278089ef5ca4f891c0b28d14073a1a0c41e87b8894b2a26b46e663890ab51a2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T02:16:44Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T02:16:44Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T02:16:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a278089ef5ca4f891c0b28d14073a1a0c41e87b8894b2a26b46e663890ab51a2"}
{"level":"info","ts":"2026-07-24T02:16:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a278089ef5ca4f891c0b28d14073a1a0c41e87b8894b2a26b46e663890ab51a2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T02:16:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a2c1b9aa96a8fed741c328d23362ee6707888520ddf1928da8674993b488d326","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T02:16:44Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T02:16:44Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T02:16:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a2c1b9aa96a8fed741c328d23362ee6707888520ddf1928da8674993b488d326"}
{"level":"info","ts":"2026-07-24T02:16:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a2c1b9aa96a8fed741c328d23362ee6707888520ddf1928da8674993b488d326","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T02:16:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a278089ef5ca4f891c0b28d14073a1a0c41e87b8894b2a26b46e663890ab51a2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T02:16:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a2c1b9aa96a8fed741c328d23362ee6707888520ddf1928da8674993b488d326","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T02:16:44Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T02:16:44Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a2c1b9aa96a8fed741c328d23362ee6707888520ddf1928da8674993b488d326"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T02:16:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a2c1b9aa96a8fed741c328d23362ee6707888520ddf1928da8674993b488d326","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T02:16:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a278089ef5ca4f891c0b28d14073a1a0c41e87b8894b2a26b46e663890ab51a2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T02:16:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a2c1b9aa96a8fed741c328d23362ee6707888520ddf1928da8674993b488d326","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T02:16:44Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T02:16:44Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a2c1b9aa96a8fed741c328d23362ee6707888520ddf1928da8674993b488d326"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T02:16:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a278089ef5ca4f891c0b28d14073a1a0c41e87b8894b2a26b46e663890ab51a2"}
{"level":"error","ts":"2026-07-24T02:16:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"a2c1b9aa96a8fed741c328d23362ee6707888520ddf1928da8674993b488d326","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a2c1b9aa96a8fed741c328d23362ee6707888520ddf1928da8674993b488d326\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-24T02:16:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f689433ebc678aa54a86ce9b38c0b7db6b5c946270b5120207f2b2aa3b46a8bd","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T02:16:44Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T02:16:44Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T02:16:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f689433ebc678aa54a86ce9b38c0b7db6b5c946270b5120207f2b2aa3b46a8bd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T02:16:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a2c1b9aa96a8fed741c328d23362ee6707888520ddf1928da8674993b488d326","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T02:16:44Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T02:16:44Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T02:16:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a2c1b9aa96a8fed741c328d23362ee6707888520ddf1928da8674993b488d326"}
{"level":"info","ts":"2026-07-24T02:16:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a2c1b9aa96a8fed741c328d23362ee6707888520ddf1928da8674993b488d326","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T02:16:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a278089ef5ca4f891c0b28d14073a1a0c41e87b8894b2a26b46e663890ab51a2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T02:16:44Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T02:16:44Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a278089ef5ca4f891c0b28d14073a1a0c41e87b8894b2a26b46e663890ab51a2"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T02:16:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f689433ebc678aa54a86ce9b38c0b7db6b5c946270b5120207f2b2aa3b46a8bd"}
{"level":"info","ts":"2026-07-24T02:16:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a278089ef5ca4f891c0b28d14073a1a0c41e87b8894b2a26b46e663890ab51a2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T02:16:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f689433ebc678aa54a86ce9b38c0b7db6b5c946270b5120207f2b2aa3b46a8bd","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T02:16:44Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T02:16:44Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["f689433ebc678aa54a86ce9b38c0b7db6b5c946270b5120207f2b2aa3b46a8bd"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T02:16:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f689433ebc678aa54a86ce9b38c0b7db6b5c946270b5120207f2b2aa3b46a8bd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T02:16:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a2c1b9aa96a8fed741c328d23362ee6707888520ddf1928da8674993b488d326","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T02:16:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a278089ef5ca4f891c0b28d14073a1a0c41e87b8894b2a26b46e663890ab51a2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T02:16:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f689433ebc678aa54a86ce9b38c0b7db6b5c946270b5120207f2b2aa3b46a8bd","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T02:16:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a2c1b9aa96a8fed741c328d23362ee6707888520ddf1928da8674993b488d326"}
{"level":"debug","ts":"2026-07-24T02:16:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a2c1b9aa96a8fed741c328d23362ee6707888520ddf1928da8674993b488d326","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T02:16:44Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T02:16:44Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a2c1b9aa96a8fed741c328d23362ee6707888520ddf1928da8674993b488d326"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T02:16:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a278089ef5ca4f891c0b28d14073a1a0c41e87b8894b2a26b46e663890ab51a2"}
{"level":"info","ts":"2026-07-24T02:16:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a2c1b9aa96a8fed741c328d23362ee6707888520ddf1928da8674993b488d326","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T02:16:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a2c1b9aa96a8fed741c328d23362ee6707888520ddf1928da8674993b488d326","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T02:16:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f689433ebc678aa54a86ce9b38c0b7db6b5c946270b5120207f2b2aa3b46a8bd"}
{"level":"info","ts":"2026-07-24T02:16:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a2c1b9aa96a8fed741c328d23362ee6707888520ddf1928da8674993b488d326"}
{"level":"debug","ts":"2026-07-24T02:16:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e9199880cc671d673e1ba5bdb04231d13599cec91381bbbb848dac80f6e40aeb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T02:16:44Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T02:16:44Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T02:16:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e9199880cc671d673e1ba5bdb04231d13599cec91381bbbb848dac80f6e40aeb"}
{"level":"info","ts":"2026-07-24T02:16:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e9199880cc671d673e1ba5bdb04231d13599cec91381bbbb848dac80f6e40aeb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T02:16:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e9199880cc671d673e1ba5bdb04231d13599cec91381bbbb848dac80f6e40aeb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T02:16:44Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T02:16:44Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e9199880cc671d673e1ba5bdb04231d13599cec91381bbbb848dac80f6e40aeb"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T02:16:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e9199880cc671d673e1ba5bdb04231d13599cec91381bbbb848dac80f6e40aeb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T02:16:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e9199880cc671d673e1ba5bdb04231d13599cec91381bbbb848dac80f6e40aeb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T02:16:44Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T02:16:44Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T02:16:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e9199880cc671d673e1ba5bdb04231d13599cec91381bbbb848dac80f6e40aeb"}
{"level":"error","ts":"2026-07-24T02:16:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"e9199880cc671d673e1ba5bdb04231d13599cec91381bbbb848dac80f6e40aeb","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"e9199880cc671d673e1ba5bdb04231d13599cec91381bbbb848dac80f6e40aeb\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-24T02:16:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e9199880cc671d673e1ba5bdb04231d13599cec91381bbbb848dac80f6e40aeb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T02:16:44Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T02:16:44Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T02:16:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e9199880cc671d673e1ba5bdb04231d13599cec91381bbbb848dac80f6e40aeb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T02:16:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e9199880cc671d673e1ba5bdb04231d13599cec91381bbbb848dac80f6e40aeb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T02:16:44Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T02:16:44Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T02:16:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e9199880cc671d673e1ba5bdb04231d13599cec91381bbbb848dac80f6e40aeb"}
{"level":"error","ts":"2026-07-24T02:16:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"e9199880cc671d673e1ba5bdb04231d13599cec91381bbbb848dac80f6e40aeb","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"e9199880cc671d673e1ba5bdb04231d13599cec91381bbbb848dac80f6e40aeb\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-24T02:16:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e9199880cc671d673e1ba5bdb04231d13599cec91381bbbb848dac80f6e40aeb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T02:16:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e9199880cc671d673e1ba5bdb04231d13599cec91381bbbb848dac80f6e40aeb","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T02:16:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e9199880cc671d673e1ba5bdb04231d13599cec91381bbbb848dac80f6e40aeb"}
{"level":"debug","ts":"2026-07-24T02:16:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"959da5c9e087f50cc281487821ddba0245e0aa36aa9ff5a486993c39bf670946","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T02:16:44Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T02:16:44Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T02:16:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"959da5c9e087f50cc281487821ddba0245e0aa36aa9ff5a486993c39bf670946","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T02:16:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"959da5c9e087f50cc281487821ddba0245e0aa36aa9ff5a486993c39bf670946","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T02:16:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/959da5c9e087f50cc281487821ddba0245e0aa36aa9ff5a486993c39bf670946"}
{"level":"debug","ts":"2026-07-24T02:16:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"959da5c9e087f50cc281487821ddba0245e0aa36aa9ff5a486993c39bf670946","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T02:16:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/959da5c9e087f50cc281487821ddba0245e0aa36aa9ff5a486993c39bf670946"}
{"level":"debug","ts":"2026-07-24T02:16:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"959da5c9e087f50cc281487821ddba0245e0aa36aa9ff5a486993c39bf670946","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T02:16:44Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T02:16:44Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["959da5c9e087f50cc281487821ddba0245e0aa36aa9ff5a486993c39bf670946"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T02:16:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"959da5c9e087f50cc281487821ddba0245e0aa36aa9ff5a486993c39bf670946","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T02:16:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e9199880cc671d673e1ba5bdb04231d13599cec91381bbbb848dac80f6e40aeb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T02:16:44Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T02:16:44Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e9199880cc671d673e1ba5bdb04231d13599cec91381bbbb848dac80f6e40aeb"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T02:16:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e9199880cc671d673e1ba5bdb04231d13599cec91381bbbb848dac80f6e40aeb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T02:16:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"959da5c9e087f50cc281487821ddba0245e0aa36aa9ff5a486993c39bf670946","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T02:16:44Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T02:16:44Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T02:16:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/959da5c9e087f50cc281487821ddba0245e0aa36aa9ff5a486993c39bf670946"}
{"level":"info","ts":"2026-07-24T02:16:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"959da5c9e087f50cc281487821ddba0245e0aa36aa9ff5a486993c39bf670946","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T02:16:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e9199880cc671d673e1ba5bdb04231d13599cec91381bbbb848dac80f6e40aeb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T02:16:44Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T02:16:44Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T02:16:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e9199880cc671d673e1ba5bdb04231d13599cec91381bbbb848dac80f6e40aeb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T02:16:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"959da5c9e087f50cc281487821ddba0245e0aa36aa9ff5a486993c39bf670946","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T02:16:44Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T02:16:44Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["959da5c9e087f50cc281487821ddba0245e0aa36aa9ff5a486993c39bf670946"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T02:16:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e9199880cc671d673e1ba5bdb04231d13599cec91381bbbb848dac80f6e40aeb"}
{"level":"info","ts":"2026-07-24T02:16:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"959da5c9e087f50cc281487821ddba0245e0aa36aa9ff5a486993c39bf670946","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T02:16:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e9199880cc671d673e1ba5bdb04231d13599cec91381bbbb848dac80f6e40aeb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T02:16:44Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T02:16:44Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e9199880cc671d673e1ba5bdb04231d13599cec91381bbbb848dac80f6e40aeb"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T02:16:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/959da5c9e087f50cc281487821ddba0245e0aa36aa9ff5a486993c39bf670946"}
{"level":"info","ts":"2026-07-24T02:16:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e9199880cc671d673e1ba5bdb04231d13599cec91381bbbb848dac80f6e40aeb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T02:16:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0b79094258c1a73fa53a49157e332f188c52cc1f97ec87f6fe08f117b310a8f6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T02:16:44Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T02:16:44Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T02:16:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0b79094258c1a73fa53a49157e332f188c52cc1f97ec87f6fe08f117b310a8f6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T02:16:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"959da5c9e087f50cc281487821ddba0245e0aa36aa9ff5a486993c39bf670946","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T02:16:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e9199880cc671d673e1ba5bdb04231d13599cec91381bbbb848dac80f6e40aeb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T02:16:44Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T02:16:44Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T02:16:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e9199880cc671d673e1ba5bdb04231d13599cec91381bbbb848dac80f6e40aeb"}
{"level":"info","ts":"2026-07-24T02:16:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e9199880cc671d673e1ba5bdb04231d13599cec91381bbbb848dac80f6e40aeb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T02:16:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0b79094258c1a73fa53a49157e332f188c52cc1f97ec87f6fe08f117b310a8f6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T02:16:44Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T02:16:44Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0b79094258c1a73fa53a49157e332f188c52cc1f97ec87f6fe08f117b310a8f6"}
{"level":"info","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0b79094258c1a73fa53a49157e332f188c52cc1f97ec87f6fe08f117b310a8f6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e9199880cc671d673e1ba5bdb04231d13599cec91381bbbb848dac80f6e40aeb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T02:16:45Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T02:16:45Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e9199880cc671d673e1ba5bdb04231d13599cec91381bbbb848dac80f6e40aeb"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e9199880cc671d673e1ba5bdb04231d13599cec91381bbbb848dac80f6e40aeb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0b79094258c1a73fa53a49157e332f188c52cc1f97ec87f6fe08f117b310a8f6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T02:16:45Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T02:16:45Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["0b79094258c1a73fa53a49157e332f188c52cc1f97ec87f6fe08f117b310a8f6"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/959da5c9e087f50cc281487821ddba0245e0aa36aa9ff5a486993c39bf670946"}
{"level":"info","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0b79094258c1a73fa53a49157e332f188c52cc1f97ec87f6fe08f117b310a8f6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e9199880cc671d673e1ba5bdb04231d13599cec91381bbbb848dac80f6e40aeb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T02:16:45Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T02:16:45Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e9199880cc671d673e1ba5bdb04231d13599cec91381bbbb848dac80f6e40aeb"}
{"level":"info","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e9199880cc671d673e1ba5bdb04231d13599cec91381bbbb848dac80f6e40aeb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0b79094258c1a73fa53a49157e332f188c52cc1f97ec87f6fe08f117b310a8f6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T02:16:45Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T02:16:45Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0b79094258c1a73fa53a49157e332f188c52cc1f97ec87f6fe08f117b310a8f6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e9199880cc671d673e1ba5bdb04231d13599cec91381bbbb848dac80f6e40aeb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T02:16:45Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T02:16:45Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e9199880cc671d673e1ba5bdb04231d13599cec91381bbbb848dac80f6e40aeb"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0b79094258c1a73fa53a49157e332f188c52cc1f97ec87f6fe08f117b310a8f6"}
{"level":"info","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e9199880cc671d673e1ba5bdb04231d13599cec91381bbbb848dac80f6e40aeb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0b79094258c1a73fa53a49157e332f188c52cc1f97ec87f6fe08f117b310a8f6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T02:16:45Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T02:16:45Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["0b79094258c1a73fa53a49157e332f188c52cc1f97ec87f6fe08f117b310a8f6"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e9199880cc671d673e1ba5bdb04231d13599cec91381bbbb848dac80f6e40aeb"}
{"level":"info","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0b79094258c1a73fa53a49157e332f188c52cc1f97ec87f6fe08f117b310a8f6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e9199880cc671d673e1ba5bdb04231d13599cec91381bbbb848dac80f6e40aeb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0b79094258c1a73fa53a49157e332f188c52cc1f97ec87f6fe08f117b310a8f6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T02:16:45Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T02:16:45Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0b79094258c1a73fa53a49157e332f188c52cc1f97ec87f6fe08f117b310a8f6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0b79094258c1a73fa53a49157e332f188c52cc1f97ec87f6fe08f117b310a8f6","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0b79094258c1a73fa53a49157e332f188c52cc1f97ec87f6fe08f117b310a8f6"}
{"level":"debug","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0b79094258c1a73fa53a49157e332f188c52cc1f97ec87f6fe08f117b310a8f6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T02:16:45Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T02:16:45Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["0b79094258c1a73fa53a49157e332f188c52cc1f97ec87f6fe08f117b310a8f6"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0b79094258c1a73fa53a49157e332f188c52cc1f97ec87f6fe08f117b310a8f6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0b79094258c1a73fa53a49157e332f188c52cc1f97ec87f6fe08f117b310a8f6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2bac4f229193a7fc46187767d04349ea18fc0abcdab1f9c0423dc03550dc95e7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T02:16:45Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T02:16:45Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e9199880cc671d673e1ba5bdb04231d13599cec91381bbbb848dac80f6e40aeb"}
{"level":"info","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2bac4f229193a7fc46187767d04349ea18fc0abcdab1f9c0423dc03550dc95e7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2bac4f229193a7fc46187767d04349ea18fc0abcdab1f9c0423dc03550dc95e7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2bac4f229193a7fc46187767d04349ea18fc0abcdab1f9c0423dc03550dc95e7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2bac4f229193a7fc46187767d04349ea18fc0abcdab1f9c0423dc03550dc95e7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0b79094258c1a73fa53a49157e332f188c52cc1f97ec87f6fe08f117b310a8f6"}
{"level":"info","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2bac4f229193a7fc46187767d04349ea18fc0abcdab1f9c0423dc03550dc95e7"}
{"level":"debug","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2bac4f229193a7fc46187767d04349ea18fc0abcdab1f9c0423dc03550dc95e7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T02:16:45Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T02:16:45Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["2bac4f229193a7fc46187767d04349ea18fc0abcdab1f9c0423dc03550dc95e7"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2bac4f229193a7fc46187767d04349ea18fc0abcdab1f9c0423dc03550dc95e7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2bac4f229193a7fc46187767d04349ea18fc0abcdab1f9c0423dc03550dc95e7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T02:16:45Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T02:16:45Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2bac4f229193a7fc46187767d04349ea18fc0abcdab1f9c0423dc03550dc95e7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"645fbeb3a61db3a72cc60305394f288052ee9b70dfb6a0c0ff1e615639d89edc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T02:16:45Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T02:16:45Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2bac4f229193a7fc46187767d04349ea18fc0abcdab1f9c0423dc03550dc95e7"}
{"level":"info","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"645fbeb3a61db3a72cc60305394f288052ee9b70dfb6a0c0ff1e615639d89edc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2bac4f229193a7fc46187767d04349ea18fc0abcdab1f9c0423dc03550dc95e7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T02:16:45Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T02:16:45Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["2bac4f229193a7fc46187767d04349ea18fc0abcdab1f9c0423dc03550dc95e7"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2bac4f229193a7fc46187767d04349ea18fc0abcdab1f9c0423dc03550dc95e7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1700ad624c8783b7f03ce6e84ba409ac436e65ada1b612fd12621c944387274a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T02:16:45Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T02:16:45Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/645fbeb3a61db3a72cc60305394f288052ee9b70dfb6a0c0ff1e615639d89edc"}
{"level":"info","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1700ad624c8783b7f03ce6e84ba409ac436e65ada1b612fd12621c944387274a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"645fbeb3a61db3a72cc60305394f288052ee9b70dfb6a0c0ff1e615639d89edc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T02:16:45Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T02:16:45Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["645fbeb3a61db3a72cc60305394f288052ee9b70dfb6a0c0ff1e615639d89edc"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1700ad624c8783b7f03ce6e84ba409ac436e65ada1b612fd12621c944387274a"}
{"level":"info","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"645fbeb3a61db3a72cc60305394f288052ee9b70dfb6a0c0ff1e615639d89edc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2bac4f229193a7fc46187767d04349ea18fc0abcdab1f9c0423dc03550dc95e7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T02:16:45Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T02:16:45Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2bac4f229193a7fc46187767d04349ea18fc0abcdab1f9c0423dc03550dc95e7"}
{"level":"info","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2bac4f229193a7fc46187767d04349ea18fc0abcdab1f9c0423dc03550dc95e7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1700ad624c8783b7f03ce6e84ba409ac436e65ada1b612fd12621c944387274a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T02:16:45Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T02:16:45Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1700ad624c8783b7f03ce6e84ba409ac436e65ada1b612fd12621c944387274a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1700ad624c8783b7f03ce6e84ba409ac436e65ada1b612fd12621c944387274a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"645fbeb3a61db3a72cc60305394f288052ee9b70dfb6a0c0ff1e615639d89edc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T02:16:45Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T02:16:45Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/645fbeb3a61db3a72cc60305394f288052ee9b70dfb6a0c0ff1e615639d89edc"}
{"level":"info","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"645fbeb3a61db3a72cc60305394f288052ee9b70dfb6a0c0ff1e615639d89edc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2bac4f229193a7fc46187767d04349ea18fc0abcdab1f9c0423dc03550dc95e7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T02:16:45Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T02:16:45Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["2bac4f229193a7fc46187767d04349ea18fc0abcdab1f9c0423dc03550dc95e7"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1700ad624c8783b7f03ce6e84ba409ac436e65ada1b612fd12621c944387274a"}
{"level":"info","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2bac4f229193a7fc46187767d04349ea18fc0abcdab1f9c0423dc03550dc95e7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1700ad624c8783b7f03ce6e84ba409ac436e65ada1b612fd12621c944387274a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"645fbeb3a61db3a72cc60305394f288052ee9b70dfb6a0c0ff1e615639d89edc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T02:16:45Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T02:16:45Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["645fbeb3a61db3a72cc60305394f288052ee9b70dfb6a0c0ff1e615639d89edc"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"645fbeb3a61db3a72cc60305394f288052ee9b70dfb6a0c0ff1e615639d89edc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2bac4f229193a7fc46187767d04349ea18fc0abcdab1f9c0423dc03550dc95e7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T02:16:45Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T02:16:45Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2bac4f229193a7fc46187767d04349ea18fc0abcdab1f9c0423dc03550dc95e7"}
{"level":"info","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2bac4f229193a7fc46187767d04349ea18fc0abcdab1f9c0423dc03550dc95e7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"645fbeb3a61db3a72cc60305394f288052ee9b70dfb6a0c0ff1e615639d89edc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T02:16:45Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T02:16:45Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/645fbeb3a61db3a72cc60305394f288052ee9b70dfb6a0c0ff1e615639d89edc"}
{"level":"info","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"645fbeb3a61db3a72cc60305394f288052ee9b70dfb6a0c0ff1e615639d89edc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2bac4f229193a7fc46187767d04349ea18fc0abcdab1f9c0423dc03550dc95e7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"645fbeb3a61db3a72cc60305394f288052ee9b70dfb6a0c0ff1e615639d89edc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T02:16:45Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T02:16:45Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["645fbeb3a61db3a72cc60305394f288052ee9b70dfb6a0c0ff1e615639d89edc"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2bac4f229193a7fc46187767d04349ea18fc0abcdab1f9c0423dc03550dc95e7"}
{"level":"info","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/645fbeb3a61db3a72cc60305394f288052ee9b70dfb6a0c0ff1e615639d89edc"}
{"level":"info","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"645fbeb3a61db3a72cc60305394f288052ee9b70dfb6a0c0ff1e615639d89edc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2bac4f229193a7fc46187767d04349ea18fc0abcdab1f9c0423dc03550dc95e7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T02:16:45Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T02:16:45Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["2bac4f229193a7fc46187767d04349ea18fc0abcdab1f9c0423dc03550dc95e7"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/059e91ee28b4df0e3ba6ab798eb061206cfa52cfb8be91f286b855176c93435d"}
{"level":"info","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/645fbeb3a61db3a72cc60305394f288052ee9b70dfb6a0c0ff1e615639d89edc"}
{"level":"info","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2bac4f229193a7fc46187767d04349ea18fc0abcdab1f9c0423dc03550dc95e7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"059e91ee28b4df0e3ba6ab798eb061206cfa52cfb8be91f286b855176c93435d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T02:16:45Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T02:16:45Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["059e91ee28b4df0e3ba6ab798eb061206cfa52cfb8be91f286b855176c93435d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2dcdcc80481532a5195a7ec4636ff252433ae2dd0878c4091166cde5b50dbcb6"}
{"level":"info","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2bac4f229193a7fc46187767d04349ea18fc0abcdab1f9c0423dc03550dc95e7"}
{"level":"info","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"059e91ee28b4df0e3ba6ab798eb061206cfa52cfb8be91f286b855176c93435d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"645fbeb3a61db3a72cc60305394f288052ee9b70dfb6a0c0ff1e615639d89edc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2dcdcc80481532a5195a7ec4636ff252433ae2dd0878c4091166cde5b50dbcb6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T02:16:45Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T02:16:45Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["2dcdcc80481532a5195a7ec4636ff252433ae2dd0878c4091166cde5b50dbcb6"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a39c82467db8d9263b3bf41d3b7a74835d59be4300345235a72b9488c5f0cda8"}
{"level":"info","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/059e91ee28b4df0e3ba6ab798eb061206cfa52cfb8be91f286b855176c93435d"}
{"level":"info","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2dcdcc80481532a5195a7ec4636ff252433ae2dd0878c4091166cde5b50dbcb6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2bac4f229193a7fc46187767d04349ea18fc0abcdab1f9c0423dc03550dc95e7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a39c82467db8d9263b3bf41d3b7a74835d59be4300345235a72b9488c5f0cda8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T02:16:45Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T02:16:45Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a39c82467db8d9263b3bf41d3b7a74835d59be4300345235a72b9488c5f0cda8"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2dcdcc80481532a5195a7ec4636ff252433ae2dd0878c4091166cde5b50dbcb6"}
{"level":"info","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a39c82467db8d9263b3bf41d3b7a74835d59be4300345235a72b9488c5f0cda8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"059e91ee28b4df0e3ba6ab798eb061206cfa52cfb8be91f286b855176c93435d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2dcdcc80481532a5195a7ec4636ff252433ae2dd0878c4091166cde5b50dbcb6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a39c82467db8d9263b3bf41d3b7a74835d59be4300345235a72b9488c5f0cda8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T02:16:45Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T02:16:45Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a39c82467db8d9263b3bf41d3b7a74835d59be4300345235a72b9488c5f0cda8"}
{"level":"info","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a39c82467db8d9263b3bf41d3b7a74835d59be4300345235a72b9488c5f0cda8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a39c82467db8d9263b3bf41d3b7a74835d59be4300345235a72b9488c5f0cda8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a39c82467db8d9263b3bf41d3b7a74835d59be4300345235a72b9488c5f0cda8","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a39c82467db8d9263b3bf41d3b7a74835d59be4300345235a72b9488c5f0cda8"}
{"level":"debug","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a39c82467db8d9263b3bf41d3b7a74835d59be4300345235a72b9488c5f0cda8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T02:16:45Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T02:16:45Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a39c82467db8d9263b3bf41d3b7a74835d59be4300345235a72b9488c5f0cda8"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a39c82467db8d9263b3bf41d3b7a74835d59be4300345235a72b9488c5f0cda8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a39c82467db8d9263b3bf41d3b7a74835d59be4300345235a72b9488c5f0cda8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T02:16:45Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T02:16:45Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a39c82467db8d9263b3bf41d3b7a74835d59be4300345235a72b9488c5f0cda8"}
{"level":"info","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a39c82467db8d9263b3bf41d3b7a74835d59be4300345235a72b9488c5f0cda8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a39c82467db8d9263b3bf41d3b7a74835d59be4300345235a72b9488c5f0cda8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a39c82467db8d9263b3bf41d3b7a74835d59be4300345235a72b9488c5f0cda8","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a39c82467db8d9263b3bf41d3b7a74835d59be4300345235a72b9488c5f0cda8"}
{"level":"debug","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a39c82467db8d9263b3bf41d3b7a74835d59be4300345235a72b9488c5f0cda8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T02:16:45Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T02:16:45Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a39c82467db8d9263b3bf41d3b7a74835d59be4300345235a72b9488c5f0cda8"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a39c82467db8d9263b3bf41d3b7a74835d59be4300345235a72b9488c5f0cda8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a39c82467db8d9263b3bf41d3b7a74835d59be4300345235a72b9488c5f0cda8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T02:16:45Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T02:16:45Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a39c82467db8d9263b3bf41d3b7a74835d59be4300345235a72b9488c5f0cda8"}
{"level":"info","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a39c82467db8d9263b3bf41d3b7a74835d59be4300345235a72b9488c5f0cda8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a39c82467db8d9263b3bf41d3b7a74835d59be4300345235a72b9488c5f0cda8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a39c82467db8d9263b3bf41d3b7a74835d59be4300345235a72b9488c5f0cda8","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a39c82467db8d9263b3bf41d3b7a74835d59be4300345235a72b9488c5f0cda8"}
{"level":"debug","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a39c82467db8d9263b3bf41d3b7a74835d59be4300345235a72b9488c5f0cda8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T02:16:45Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T02:16:45Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a39c82467db8d9263b3bf41d3b7a74835d59be4300345235a72b9488c5f0cda8"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a39c82467db8d9263b3bf41d3b7a74835d59be4300345235a72b9488c5f0cda8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a39c82467db8d9263b3bf41d3b7a74835d59be4300345235a72b9488c5f0cda8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T02:16:45Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T02:16:45Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a39c82467db8d9263b3bf41d3b7a74835d59be4300345235a72b9488c5f0cda8"}
{"level":"info","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a39c82467db8d9263b3bf41d3b7a74835d59be4300345235a72b9488c5f0cda8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T02:16:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a39c82467db8d9263b3bf41d3b7a74835d59be4300345235a72b9488c5f0cda8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T02:16:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a39c82467db8d9263b3bf41d3b7a74835d59be4300345235a72b9488c5f0cda8","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T02:16:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a39c82467db8d9263b3bf41d3b7a74835d59be4300345235a72b9488c5f0cda8"}
{"level":"debug","ts":"2026-07-24T02:16:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a39c82467db8d9263b3bf41d3b7a74835d59be4300345235a72b9488c5f0cda8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T02:16:46Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T02:16:46Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a39c82467db8d9263b3bf41d3b7a74835d59be4300345235a72b9488c5f0cda8"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T02:16:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a39c82467db8d9263b3bf41d3b7a74835d59be4300345235a72b9488c5f0cda8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T02:16:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a39c82467db8d9263b3bf41d3b7a74835d59be4300345235a72b9488c5f0cda8","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T02:16:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a39c82467db8d9263b3bf41d3b7a74835d59be4300345235a72b9488c5f0cda8"}
{"level":"info","ts":"2026-07-24T02:16:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f02c0a1d-e724-4410-9296-d7998de3cf42","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:52130","PortSpecifier":{"PortValue":52130}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.67:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f02c0a1d-e724-4410-9296-d7998de3cf42","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-ipp-a-a002f7.apps.3cc369e0-6f69-4650-90d5-28c99b380518.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T02:16:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f02c0a1d-e724-4410-9296-d7998de3cf42","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:52130","PortSpecifier":{"PortValue":52130}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.67:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784859413,"nanos":461960348},"http":{"id":"f02c0a1d-e724-4410-9296-d7998de3cf42","method":"POST","headers":{":authority":"e2e-ipp-a-a002f7.apps.3cc369e0-6f69-4650-90d5-28c99b380518.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T02:16:53Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"f02c0a1d-e724-4410-9296-d7998de3cf42","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-24T02:16:53Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f02c0a1d-e724-4410-9296-d7998de3cf42","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"f29f66c2-a19e-4465-a7c7-78c9c558bf70","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=418f119d-8728-4d81-ae00-6c04fed31bc9"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/28c99b380518"]}}
{"level":"debug","ts":"2026-07-24T02:16:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f02c0a1d-e724-4410-9296-d7998de3cf42","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/28c99b380518"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=418f119d-8728-4d81-ae00-6c04fed31bc9"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"f29f66c2-a19e-4465-a7c7-78c9c558bf70","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"645fbeb3a61db3a72cc60305394f288052ee9b70dfb6a0c0ff1e615639d89edc"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.67:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-ipp-a-a002f7.apps.3cc369e0-6f69-4650-90d5-28c99b380518.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T02:16:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f02c0a1d-e724-4410-9296-d7998de3cf42","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T02:16:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f02c0a1d-e724-4410-9296-d7998de3cf42","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T02:16:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f02c0a1d-e724-4410-9296-d7998de3cf42","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-ipp-a-a002f7/ipp-route-a002f7\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-ipp-a-a002f7/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T02:16:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"f02c0a1d-e724-4410-9296-d7998de3cf42","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-24T02:16:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f02c0a1d-e724-4410-9296-d7998de3cf42","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T02:16:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f02c0a1d-e724-4410-9296-d7998de3cf42","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-24T02:16:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f02c0a1d-e724-4410-9296-d7998de3cf42","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T02:16:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f02c0a1d-e724-4410-9296-d7998de3cf42","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T02:16:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"882b4448-f1cd-4e9d-8a9c-6086b585a779","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:52140","PortSpecifier":{"PortValue":52140}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.67:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"882b4448-f1cd-4e9d-8a9c-6086b585a779","method":"POST","path":"/ai-tenant-e2e-ipp-a-a002f7/ipp-route-a002f7/v1/chat/completions","host":"e2e-ipp-a-a002f7.apps.3cc369e0-6f69-4650-90d5-28c99b380518.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T02:16:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"882b4448-f1cd-4e9d-8a9c-6086b585a779","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:52140","PortSpecifier":{"PortValue":52140}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.67:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784859415,"nanos":524462162},"http":{"id":"882b4448-f1cd-4e9d-8a9c-6086b585a779","method":"POST","headers":{":authority":"e2e-ipp-a-a002f7.apps.3cc369e0-6f69-4650-90d5-28c99b380518.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-ipp-a-a002f7/ipp-route-a002f7/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T02:16:55Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"882b4448-f1cd-4e9d-8a9c-6086b585a779","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-gNwPS8bF3AtaDdNH_hFzKpuxARgkGRXh8HEKM457gpQVs0zW0uVbffoQYVh6"}
{"level":"debug","ts":"2026-07-24T02:16:55Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"882b4448-f1cd-4e9d-8a9c-6086b585a779","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-ipp-a-a002f7.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-gNwPS8bF3AtaDdNH_hFzKpuxARgkGRXh8HEKM457gpQVs0zW0uVbffoQYVh6\"}"}
{"level":"debug","ts":"2026-07-24T02:16:55Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"882b4448-f1cd-4e9d-8a9c-6086b585a779","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-ipp-a-a002f7.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"ef0921b6-87b0-4e51-9c62-dfad0eb60806","keyName":"e2e-ipp-a002f7","subscription":"ipp-route-a002f7-sub","tenant":"e2e-ipp-a-a002f7","userId":"ef0921b6-87b0-4e51-9c62-dfad0eb60806","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T02:16:55Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"882b4448-f1cd-4e9d-8a9c-6086b585a779","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-ipp-a-a002f7.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-ipp-a-a002f7/ipp-route-a002f7\",\"requestedSubscription\":\"ipp-route-a002f7-sub\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T02:16:55Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"882b4448-f1cd-4e9d-8a9c-6086b585a779","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-ipp-a-a002f7.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"ipp-route-a002f7","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"ipp-route-a002f7-sub","namespace":"ai-tenant-e2e-ipp-a-a002f7","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-ipp-a-a002f7/ipp-route-a002f7"}}
{"level":"debug","ts":"2026-07-24T02:16:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"882b4448-f1cd-4e9d-8a9c-6086b585a779","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T02:16:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"882b4448-f1cd-4e9d-8a9c-6086b585a779","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T02:16:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"882b4448-f1cd-4e9d-8a9c-6086b585a779","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T02:16:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"882b4448-f1cd-4e9d-8a9c-6086b585a779","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T02:16:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"882b4448-f1cd-4e9d-8a9c-6086b585a779","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-ipp-a-a002f7/ipp-route-a002f7\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-ipp-a-a002f7/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T02:16:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"882b4448-f1cd-4e9d-8a9c-6086b585a779","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T02:16:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"882b4448-f1cd-4e9d-8a9c-6086b585a779","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"ipp-route-a002f7-sub"}
{"level":"debug","ts":"2026-07-24T02:16:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"882b4448-f1cd-4e9d-8a9c-6086b585a779","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T02:16:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"882b4448-f1cd-4e9d-8a9c-6086b585a779","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"ef0921b6-87b0-4e51-9c62-dfad0eb60806","keyName":"e2e-ipp-a002f7","selected_subscription":"ipp-route-a002f7-sub","selected_subscription_key":"ai-tenant-e2e-ipp-a-a002f7/ipp-route-a002f7-sub@ai-tenant-e2e-ipp-a-a002f7/ipp-route-a002f7","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"ipp-route-a002f7","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"ipp-route-a002f7-sub","namespace":"ai-tenant-e2e-ipp-a-a002f7","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-ipp-a-a002f7/ipp-route-a002f7"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T02:16:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"882b4448-f1cd-4e9d-8a9c-6086b585a779","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T02:16:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"882b4448-f1cd-4e9d-8a9c-6086b585a779","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T02:18:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e9199880cc671d673e1ba5bdb04231d13599cec91381bbbb848dac80f6e40aeb"}
{"level":"info","ts":"2026-07-24T02:18:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1700ad624c8783b7f03ce6e84ba409ac436e65ada1b612fd12621c944387274a"}
{"level":"info","ts":"2026-07-24T02:18:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/0b79094258c1a73fa53a49157e332f188c52cc1f97ec87f6fe08f117b310a8f6"}
{"level":"info","ts":"2026-07-24T02:18:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/645fbeb3a61db3a72cc60305394f288052ee9b70dfb6a0c0ff1e615639d89edc"}
{"level":"info","ts":"2026-07-24T02:18:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a39c82467db8d9263b3bf41d3b7a74835d59be4300345235a72b9488c5f0cda8"}
{"level":"info","ts":"2026-07-24T02:18:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/959da5c9e087f50cc281487821ddba0245e0aa36aa9ff5a486993c39bf670946"}
{"level":"info","ts":"2026-07-24T02:18:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f689433ebc678aa54a86ce9b38c0b7db6b5c946270b5120207f2b2aa3b46a8bd"}
{"level":"info","ts":"2026-07-24T02:18:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2bac4f229193a7fc46187767d04349ea18fc0abcdab1f9c0423dc03550dc95e7"}
{"level":"info","ts":"2026-07-24T02:18:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2dcdcc80481532a5195a7ec4636ff252433ae2dd0878c4091166cde5b50dbcb6"}
{"level":"info","ts":"2026-07-24T02:18:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a2c1b9aa96a8fed741c328d23362ee6707888520ddf1928da8674993b488d326"}
{"level":"info","ts":"2026-07-24T02:18:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a278089ef5ca4f891c0b28d14073a1a0c41e87b8894b2a26b46e663890ab51a2"}
{"level":"info","ts":"2026-07-24T02:18:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/059e91ee28b4df0e3ba6ab798eb061206cfa52cfb8be91f286b855176c93435d"}