{"level":"debug","ts":"2026-07-28T00:25:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d51e1a5b-0fa0-4d11-8b65-3456aba4ffef","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-3323b5"}
{"level":"debug","ts":"2026-07-28T00:25:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d51e1a5b-0fa0-4d11-8b65-3456aba4ffef","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-28T00:25:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d51e1a5b-0fa0-4d11-8b65-3456aba4ffef","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-28T00:25:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d51e1a5b-0fa0-4d11-8b65-3456aba4ffef","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"a57fe096-7c8a-458a-9209-dd484656490a","keyName":"e2e-rate-a-3323b5","selected_subscription":"e2e-rate-iso-a-3323b5","selected_subscription_key":"ai-tenant-e2e-shared-a-328ef1/e2e-rate-iso-a-3323b5@ai-tenant-e2e-shared-a-328ef1/rate-test-model-328ef1","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-328ef1/models/facebook/opt-125m","name":"rate-test-model-328ef1","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-3323b5","namespace":"ai-tenant-e2e-shared-a-328ef1","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-328ef1/rate-test-model-328ef1"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-28T00:25:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d51e1a5b-0fa0-4d11-8b65-3456aba4ffef","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-28T00:25:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d51e1a5b-0fa0-4d11-8b65-3456aba4ffef","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-28T00:25:14Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f04d1cb1-84aa-4ce3-85e2-c9dc163cf4d2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:52576","PortSpecifier":{"PortValue":52576}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f04d1cb1-84aa-4ce3-85e2-c9dc163cf4d2","method":"POST","path":"/ai-tenant-e2e-shared-a-328ef1/rate-test-model-328ef1/v1/completions","host":"e2e-shared-a-328ef1.apps.e05eeaa2-7b56-4c28-a8df-162e45941c70.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-28T00:25:14Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f04d1cb1-84aa-4ce3-85e2-c9dc163cf4d2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:52576","PortSpecifier":{"PortValue":52576}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785198314,"nanos":695084086},"http":{"id":"f04d1cb1-84aa-4ce3-85e2-c9dc163cf4d2","method":"POST","headers":{":authority":"e2e-shared-a-328ef1.apps.e05eeaa2-7b56-4c28-a8df-162e45941c70.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-328ef1/rate-test-model-328ef1/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T00:25:14Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f04d1cb1-84aa-4ce3-85e2-c9dc163cf4d2","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-7RJncZhc0Tg0Z53m_2y9GnxYHUDs11LpMCWNve3NKu0OtftMTlNVztwtFnQg"}
{"level":"debug","ts":"2026-07-28T00:25:14Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f04d1cb1-84aa-4ce3-85e2-c9dc163cf4d2","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-328ef1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-7RJncZhc0Tg0Z53m_2y9GnxYHUDs11LpMCWNve3NKu0OtftMTlNVztwtFnQg\"}"}
{"level":"debug","ts":"2026-07-28T00:25:14Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f04d1cb1-84aa-4ce3-85e2-c9dc163cf4d2","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-328ef1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"a57fe096-7c8a-458a-9209-dd484656490a","keyName":"e2e-rate-a-3323b5","subscription":"e2e-rate-iso-a-3323b5","tenant":"e2e-shared-a-328ef1","userId":"a57fe096-7c8a-458a-9209-dd484656490a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-28T00:25:14Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f04d1cb1-84aa-4ce3-85e2-c9dc163cf4d2","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-328ef1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-328ef1/rate-test-model-328ef1\",\"requestedSubscription\":\"e2e-rate-iso-a-3323b5\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-28T00:25:14Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f04d1cb1-84aa-4ce3-85e2-c9dc163cf4d2","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-328ef1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-328ef1/models/facebook/opt-125m","name":"rate-test-model-328ef1","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-3323b5","namespace":"ai-tenant-e2e-shared-a-328ef1","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-328ef1/rate-test-model-328ef1"}}
{"level":"debug","ts":"2026-07-28T00:25:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f04d1cb1-84aa-4ce3-85e2-c9dc163cf4d2","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T00:25:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f04d1cb1-84aa-4ce3-85e2-c9dc163cf4d2","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T00:25:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f04d1cb1-84aa-4ce3-85e2-c9dc163cf4d2","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T00:25:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f04d1cb1-84aa-4ce3-85e2-c9dc163cf4d2","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-328ef1/rate-test-model-328ef1\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-328ef1/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T00:25:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f04d1cb1-84aa-4ce3-85e2-c9dc163cf4d2","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T00:25:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f04d1cb1-84aa-4ce3-85e2-c9dc163cf4d2","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-3323b5"}
{"level":"debug","ts":"2026-07-28T00:25:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f04d1cb1-84aa-4ce3-85e2-c9dc163cf4d2","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-28T00:25:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f04d1cb1-84aa-4ce3-85e2-c9dc163cf4d2","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-28T00:25:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f04d1cb1-84aa-4ce3-85e2-c9dc163cf4d2","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"a57fe096-7c8a-458a-9209-dd484656490a","keyName":"e2e-rate-a-3323b5","selected_subscription":"e2e-rate-iso-a-3323b5","selected_subscription_key":"ai-tenant-e2e-shared-a-328ef1/e2e-rate-iso-a-3323b5@ai-tenant-e2e-shared-a-328ef1/rate-test-model-328ef1","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-328ef1/models/facebook/opt-125m","name":"rate-test-model-328ef1","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-3323b5","namespace":"ai-tenant-e2e-shared-a-328ef1","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-328ef1/rate-test-model-328ef1"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-28T00:25:14Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f04d1cb1-84aa-4ce3-85e2-c9dc163cf4d2","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-28T00:25:14Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f04d1cb1-84aa-4ce3-85e2-c9dc163cf4d2","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-28T00:25:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2eee92e3-783a-4a00-9f89-e52cb5bbec47","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:50398","PortSpecifier":{"PortValue":50398}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2eee92e3-783a-4a00-9f89-e52cb5bbec47","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-328ef1.apps.e05eeaa2-7b56-4c28-a8df-162e45941c70.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-28T00:25:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2eee92e3-783a-4a00-9f89-e52cb5bbec47","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:50398","PortSpecifier":{"PortValue":50398}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785198333,"nanos":945547626},"http":{"id":"2eee92e3-783a-4a00-9f89-e52cb5bbec47","method":"POST","headers":{":authority":"e2e-shared-a-328ef1.apps.e05eeaa2-7b56-4c28-a8df-162e45941c70.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T00:25:33Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"2eee92e3-783a-4a00-9f89-e52cb5bbec47","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-28T00:25:33Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2eee92e3-783a-4a00-9f89-e52cb5bbec47","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"f9d7f23f-32ca-4538-885d-5aa75ccad317","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=ac1bf6b3-1074-4597-a671-32089a71fe68"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/162e45941c70"]}}
{"level":"debug","ts":"2026-07-28T00:25:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2eee92e3-783a-4a00-9f89-e52cb5bbec47","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/162e45941c70"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=ac1bf6b3-1074-4597-a671-32089a71fe68"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"f9d7f23f-32ca-4538-885d-5aa75ccad317","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"60d35aa96eafc70e0055d29d7dee387f209c0bb2e0291857d86867b2691c255a"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.52:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-328ef1.apps.e05eeaa2-7b56-4c28-a8df-162e45941c70.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T00:25:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2eee92e3-783a-4a00-9f89-e52cb5bbec47","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T00:25:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2eee92e3-783a-4a00-9f89-e52cb5bbec47","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T00:25:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2eee92e3-783a-4a00-9f89-e52cb5bbec47","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-328ef1/rate-test-model-328ef1\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-328ef1/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T00:25:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"2eee92e3-783a-4a00-9f89-e52cb5bbec47","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-28T00:25:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2eee92e3-783a-4a00-9f89-e52cb5bbec47","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-28T00:25:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2eee92e3-783a-4a00-9f89-e52cb5bbec47","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-28T00:25:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2eee92e3-783a-4a00-9f89-e52cb5bbec47","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-28T00:25:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2eee92e3-783a-4a00-9f89-e52cb5bbec47","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-28T00:25:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0b138872-a500-477c-8ad9-d7814e70be90","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:41472","PortSpecifier":{"PortValue":41472}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0b138872-a500-477c-8ad9-d7814e70be90","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-6e175a.apps.e05eeaa2-7b56-4c28-a8df-162e45941c70.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-28T00:25:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0b138872-a500-477c-8ad9-d7814e70be90","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:41472","PortSpecifier":{"PortValue":41472}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785198333,"nanos":983152416},"http":{"id":"0b138872-a500-477c-8ad9-d7814e70be90","method":"POST","headers":{":authority":"e2e-shared-b-6e175a.apps.e05eeaa2-7b56-4c28-a8df-162e45941c70.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T00:25:33Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"0b138872-a500-477c-8ad9-d7814e70be90","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-28T00:25:33Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0b138872-a500-477c-8ad9-d7814e70be90","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"f9d7f23f-32ca-4538-885d-5aa75ccad317","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=ac1bf6b3-1074-4597-a671-32089a71fe68"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/162e45941c70"]}}
{"level":"debug","ts":"2026-07-28T00:25:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0b138872-a500-477c-8ad9-d7814e70be90","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/162e45941c70"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=ac1bf6b3-1074-4597-a671-32089a71fe68"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"f9d7f23f-32ca-4538-885d-5aa75ccad317","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"a496c2e859f898951090b93695c0eeb58d24d2159eb4bdbb596178c9a76b386e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.53:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-6e175a.apps.e05eeaa2-7b56-4c28-a8df-162e45941c70.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T00:25:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0b138872-a500-477c-8ad9-d7814e70be90","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T00:25:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0b138872-a500-477c-8ad9-d7814e70be90","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T00:25:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0b138872-a500-477c-8ad9-d7814e70be90","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-6e175a/rate-test-model-6e175a\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-6e175a/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T00:25:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"0b138872-a500-477c-8ad9-d7814e70be90","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-28T00:25:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0b138872-a500-477c-8ad9-d7814e70be90","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-28T00:25:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0b138872-a500-477c-8ad9-d7814e70be90","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-28T00:25:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0b138872-a500-477c-8ad9-d7814e70be90","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-28T00:25:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0b138872-a500-477c-8ad9-d7814e70be90","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-28T00:25:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1a560aa9-ce74-4673-aef5-5ab03a429e83","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:50406","PortSpecifier":{"PortValue":50406}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1a560aa9-ce74-4673-aef5-5ab03a429e83","method":"POST","path":"/ai-tenant-e2e-shared-a-328ef1/rate-test-model-328ef1/v1/completions","host":"e2e-shared-a-328ef1.apps.e05eeaa2-7b56-4c28-a8df-162e45941c70.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-28T00:25:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1a560aa9-ce74-4673-aef5-5ab03a429e83","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:50406","PortSpecifier":{"PortValue":50406}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785198334,"nanos":16374048},"http":{"id":"1a560aa9-ce74-4673-aef5-5ab03a429e83","method":"POST","headers":{":authority":"e2e-shared-a-328ef1.apps.e05eeaa2-7b56-4c28-a8df-162e45941c70.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-328ef1/rate-test-model-328ef1/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T00:25:34Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1a560aa9-ce74-4673-aef5-5ab03a429e83","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-6TocLW4wuGxGkSdh_wlIaJwDSUj7p9G43GaSlQV1zuYAobyCCzjOTfgTBZ84"}
{"level":"debug","ts":"2026-07-28T00:25:34Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1a560aa9-ce74-4673-aef5-5ab03a429e83","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-328ef1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-6TocLW4wuGxGkSdh_wlIaJwDSUj7p9G43GaSlQV1zuYAobyCCzjOTfgTBZ84\"}"}
{"level":"debug","ts":"2026-07-28T00:25:34Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1a560aa9-ce74-4673-aef5-5ab03a429e83","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-328ef1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"4bf04f49-f4b5-4302-86c4-905545c533f6","keyName":"e2e-rate-a-9fd842","subscription":"e2e-rate-iso-a-9fd842","tenant":"e2e-shared-a-328ef1","userId":"4bf04f49-f4b5-4302-86c4-905545c533f6","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-28T00:25:34Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1a560aa9-ce74-4673-aef5-5ab03a429e83","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-328ef1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-328ef1/rate-test-model-328ef1\",\"requestedSubscription\":\"e2e-rate-iso-a-9fd842\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-28T00:25:34Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1a560aa9-ce74-4673-aef5-5ab03a429e83","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-328ef1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-328ef1/models/facebook/opt-125m","name":"rate-test-model-328ef1","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-9fd842","namespace":"ai-tenant-e2e-shared-a-328ef1","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-328ef1/rate-test-model-328ef1"}}
{"level":"debug","ts":"2026-07-28T00:25:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1a560aa9-ce74-4673-aef5-5ab03a429e83","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T00:25:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1a560aa9-ce74-4673-aef5-5ab03a429e83","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T00:25:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1a560aa9-ce74-4673-aef5-5ab03a429e83","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T00:25:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1a560aa9-ce74-4673-aef5-5ab03a429e83","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-328ef1/rate-test-model-328ef1\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-328ef1/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T00:25:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1a560aa9-ce74-4673-aef5-5ab03a429e83","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T00:25:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1a560aa9-ce74-4673-aef5-5ab03a429e83","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-28T00:25:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1a560aa9-ce74-4673-aef5-5ab03a429e83","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-28T00:25:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1a560aa9-ce74-4673-aef5-5ab03a429e83","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-9fd842"}
{"level":"debug","ts":"2026-07-28T00:25:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1a560aa9-ce74-4673-aef5-5ab03a429e83","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"4bf04f49-f4b5-4302-86c4-905545c533f6","keyName":"e2e-rate-a-9fd842","selected_subscription":"e2e-rate-iso-a-9fd842","selected_subscription_key":"ai-tenant-e2e-shared-a-328ef1/e2e-rate-iso-a-9fd842@ai-tenant-e2e-shared-a-328ef1/rate-test-model-328ef1","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-328ef1/models/facebook/opt-125m","name":"rate-test-model-328ef1","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-9fd842","namespace":"ai-tenant-e2e-shared-a-328ef1","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-328ef1/rate-test-model-328ef1"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-28T00:25:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1a560aa9-ce74-4673-aef5-5ab03a429e83","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-28T00:25:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1a560aa9-ce74-4673-aef5-5ab03a429e83","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-28T00:25:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"96d5acc8-a24f-4a41-965d-0889132a323f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:50412","PortSpecifier":{"PortValue":50412}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"96d5acc8-a24f-4a41-965d-0889132a323f","method":"POST","path":"/ai-tenant-e2e-shared-a-328ef1/rate-test-model-328ef1/v1/completions","host":"e2e-shared-a-328ef1.apps.e05eeaa2-7b56-4c28-a8df-162e45941c70.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-28T00:25:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"96d5acc8-a24f-4a41-965d-0889132a323f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:50412","PortSpecifier":{"PortValue":50412}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785198335,"nanos":60825085},"http":{"id":"96d5acc8-a24f-4a41-965d-0889132a323f","method":"POST","headers":{":authority":"e2e-shared-a-328ef1.apps.e05eeaa2-7b56-4c28-a8df-162e45941c70.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-328ef1/rate-test-model-328ef1/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T00:25:35Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"96d5acc8-a24f-4a41-965d-0889132a323f","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-6TocLW4wuGxGkSdh_wlIaJwDSUj7p9G43GaSlQV1zuYAobyCCzjOTfgTBZ84"}
{"level":"debug","ts":"2026-07-28T00:25:35Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"96d5acc8-a24f-4a41-965d-0889132a323f","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-328ef1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-6TocLW4wuGxGkSdh_wlIaJwDSUj7p9G43GaSlQV1zuYAobyCCzjOTfgTBZ84\"}"}
{"level":"debug","ts":"2026-07-28T00:25:35Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"96d5acc8-a24f-4a41-965d-0889132a323f","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-328ef1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"4bf04f49-f4b5-4302-86c4-905545c533f6","keyName":"e2e-rate-a-9fd842","subscription":"e2e-rate-iso-a-9fd842","tenant":"e2e-shared-a-328ef1","userId":"4bf04f49-f4b5-4302-86c4-905545c533f6","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-28T00:25:35Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"96d5acc8-a24f-4a41-965d-0889132a323f","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-328ef1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-328ef1/rate-test-model-328ef1\",\"requestedSubscription\":\"e2e-rate-iso-a-9fd842\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-28T00:25:35Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"96d5acc8-a24f-4a41-965d-0889132a323f","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-328ef1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-328ef1/models/facebook/opt-125m","name":"rate-test-model-328ef1","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-9fd842","namespace":"ai-tenant-e2e-shared-a-328ef1","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-328ef1/rate-test-model-328ef1"}}
{"level":"debug","ts":"2026-07-28T00:25:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"96d5acc8-a24f-4a41-965d-0889132a323f","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T00:25:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"96d5acc8-a24f-4a41-965d-0889132a323f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T00:25:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"96d5acc8-a24f-4a41-965d-0889132a323f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T00:25:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"96d5acc8-a24f-4a41-965d-0889132a323f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-328ef1/rate-test-model-328ef1\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-328ef1/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T00:25:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"96d5acc8-a24f-4a41-965d-0889132a323f","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T00:25:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"96d5acc8-a24f-4a41-965d-0889132a323f","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-28T00:25:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"96d5acc8-a24f-4a41-965d-0889132a323f","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-9fd842"}
{"level":"debug","ts":"2026-07-28T00:25:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"96d5acc8-a24f-4a41-965d-0889132a323f","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-28T00:25:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"96d5acc8-a24f-4a41-965d-0889132a323f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"4bf04f49-f4b5-4302-86c4-905545c533f6","keyName":"e2e-rate-a-9fd842","selected_subscription":"e2e-rate-iso-a-9fd842","selected_subscription_key":"ai-tenant-e2e-shared-a-328ef1/e2e-rate-iso-a-9fd842@ai-tenant-e2e-shared-a-328ef1/rate-test-model-328ef1","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-328ef1/models/facebook/opt-125m","name":"rate-test-model-328ef1","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-9fd842","namespace":"ai-tenant-e2e-shared-a-328ef1","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-328ef1/rate-test-model-328ef1"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-28T00:25:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"96d5acc8-a24f-4a41-965d-0889132a323f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-28T00:25:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"96d5acc8-a24f-4a41-965d-0889132a323f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-28T00:25:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"93625c47-03a1-4867-94ae-2ea9090253d8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:50422","PortSpecifier":{"PortValue":50422}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"93625c47-03a1-4867-94ae-2ea9090253d8","method":"POST","path":"/ai-tenant-e2e-shared-a-328ef1/rate-test-model-328ef1/v1/completions","host":"e2e-shared-a-328ef1.apps.e05eeaa2-7b56-4c28-a8df-162e45941c70.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-28T00:25:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"93625c47-03a1-4867-94ae-2ea9090253d8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:50422","PortSpecifier":{"PortValue":50422}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785198336,"nanos":104290550},"http":{"id":"93625c47-03a1-4867-94ae-2ea9090253d8","method":"POST","headers":{":authority":"e2e-shared-a-328ef1.apps.e05eeaa2-7b56-4c28-a8df-162e45941c70.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-328ef1/rate-test-model-328ef1/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T00:25:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"93625c47-03a1-4867-94ae-2ea9090253d8","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-6TocLW4wuGxGkSdh_wlIaJwDSUj7p9G43GaSlQV1zuYAobyCCzjOTfgTBZ84"}
{"level":"debug","ts":"2026-07-28T00:25:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"93625c47-03a1-4867-94ae-2ea9090253d8","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-328ef1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-6TocLW4wuGxGkSdh_wlIaJwDSUj7p9G43GaSlQV1zuYAobyCCzjOTfgTBZ84\"}"}
{"level":"debug","ts":"2026-07-28T00:25:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"93625c47-03a1-4867-94ae-2ea9090253d8","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-328ef1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"4bf04f49-f4b5-4302-86c4-905545c533f6","keyName":"e2e-rate-a-9fd842","subscription":"e2e-rate-iso-a-9fd842","tenant":"e2e-shared-a-328ef1","userId":"4bf04f49-f4b5-4302-86c4-905545c533f6","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-28T00:25:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"93625c47-03a1-4867-94ae-2ea9090253d8","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-328ef1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-328ef1/rate-test-model-328ef1\",\"requestedSubscription\":\"e2e-rate-iso-a-9fd842\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-28T00:25:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"93625c47-03a1-4867-94ae-2ea9090253d8","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-328ef1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-328ef1/models/facebook/opt-125m","name":"rate-test-model-328ef1","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-9fd842","namespace":"ai-tenant-e2e-shared-a-328ef1","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-328ef1/rate-test-model-328ef1"}}
{"level":"debug","ts":"2026-07-28T00:25:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"93625c47-03a1-4867-94ae-2ea9090253d8","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T00:25:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"93625c47-03a1-4867-94ae-2ea9090253d8","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T00:25:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"93625c47-03a1-4867-94ae-2ea9090253d8","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T00:25:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"93625c47-03a1-4867-94ae-2ea9090253d8","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T00:25:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"93625c47-03a1-4867-94ae-2ea9090253d8","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-328ef1/rate-test-model-328ef1\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-328ef1/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T00:25:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"93625c47-03a1-4867-94ae-2ea9090253d8","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-28T00:25:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"93625c47-03a1-4867-94ae-2ea9090253d8","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-28T00:25:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"93625c47-03a1-4867-94ae-2ea9090253d8","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-9fd842"}
{"level":"debug","ts":"2026-07-28T00:25:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"93625c47-03a1-4867-94ae-2ea9090253d8","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"4bf04f49-f4b5-4302-86c4-905545c533f6","keyName":"e2e-rate-a-9fd842","selected_subscription":"e2e-rate-iso-a-9fd842","selected_subscription_key":"ai-tenant-e2e-shared-a-328ef1/e2e-rate-iso-a-9fd842@ai-tenant-e2e-shared-a-328ef1/rate-test-model-328ef1","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-328ef1/models/facebook/opt-125m","name":"rate-test-model-328ef1","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-9fd842","namespace":"ai-tenant-e2e-shared-a-328ef1","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-328ef1/rate-test-model-328ef1"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-28T00:25:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"93625c47-03a1-4867-94ae-2ea9090253d8","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-28T00:25:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"93625c47-03a1-4867-94ae-2ea9090253d8","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-28T00:25:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"eb454838-1da9-4f5c-9200-17f0667c4adf","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:50438","PortSpecifier":{"PortValue":50438}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"eb454838-1da9-4f5c-9200-17f0667c4adf","method":"POST","path":"/ai-tenant-e2e-shared-a-328ef1/rate-test-model-328ef1/v1/completions","host":"e2e-shared-a-328ef1.apps.e05eeaa2-7b56-4c28-a8df-162e45941c70.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-28T00:25:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"eb454838-1da9-4f5c-9200-17f0667c4adf","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:50438","PortSpecifier":{"PortValue":50438}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785198337,"nanos":142487168},"http":{"id":"eb454838-1da9-4f5c-9200-17f0667c4adf","method":"POST","headers":{":authority":"e2e-shared-a-328ef1.apps.e05eeaa2-7b56-4c28-a8df-162e45941c70.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-328ef1/rate-test-model-328ef1/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T00:25:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"eb454838-1da9-4f5c-9200-17f0667c4adf","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-6TocLW4wuGxGkSdh_wlIaJwDSUj7p9G43GaSlQV1zuYAobyCCzjOTfgTBZ84"}
{"level":"debug","ts":"2026-07-28T00:25:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"eb454838-1da9-4f5c-9200-17f0667c4adf","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-328ef1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-6TocLW4wuGxGkSdh_wlIaJwDSUj7p9G43GaSlQV1zuYAobyCCzjOTfgTBZ84\"}"}
{"level":"debug","ts":"2026-07-28T00:25:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"eb454838-1da9-4f5c-9200-17f0667c4adf","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-328ef1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"4bf04f49-f4b5-4302-86c4-905545c533f6","keyName":"e2e-rate-a-9fd842","subscription":"e2e-rate-iso-a-9fd842","tenant":"e2e-shared-a-328ef1","userId":"4bf04f49-f4b5-4302-86c4-905545c533f6","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-28T00:25:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"eb454838-1da9-4f5c-9200-17f0667c4adf","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-328ef1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-328ef1/rate-test-model-328ef1\",\"requestedSubscription\":\"e2e-rate-iso-a-9fd842\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-28T00:25:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"eb454838-1da9-4f5c-9200-17f0667c4adf","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-328ef1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-328ef1/models/facebook/opt-125m","name":"rate-test-model-328ef1","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-9fd842","namespace":"ai-tenant-e2e-shared-a-328ef1","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-328ef1/rate-test-model-328ef1"}}
{"level":"debug","ts":"2026-07-28T00:25:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"eb454838-1da9-4f5c-9200-17f0667c4adf","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T00:25:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"eb454838-1da9-4f5c-9200-17f0667c4adf","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T00:25:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"eb454838-1da9-4f5c-9200-17f0667c4adf","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T00:25:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"eb454838-1da9-4f5c-9200-17f0667c4adf","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-328ef1/rate-test-model-328ef1\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-328ef1/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T00:25:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"eb454838-1da9-4f5c-9200-17f0667c4adf","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T00:25:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"eb454838-1da9-4f5c-9200-17f0667c4adf","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-28T00:25:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"eb454838-1da9-4f5c-9200-17f0667c4adf","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-9fd842"}
{"level":"debug","ts":"2026-07-28T00:25:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"eb454838-1da9-4f5c-9200-17f0667c4adf","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-28T00:25:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"eb454838-1da9-4f5c-9200-17f0667c4adf","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"4bf04f49-f4b5-4302-86c4-905545c533f6","keyName":"e2e-rate-a-9fd842","selected_subscription":"e2e-rate-iso-a-9fd842","selected_subscription_key":"ai-tenant-e2e-shared-a-328ef1/e2e-rate-iso-a-9fd842@ai-tenant-e2e-shared-a-328ef1/rate-test-model-328ef1","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-328ef1/models/facebook/opt-125m","name":"rate-test-model-328ef1","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-9fd842","namespace":"ai-tenant-e2e-shared-a-328ef1","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-328ef1/rate-test-model-328ef1"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-28T00:25:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"eb454838-1da9-4f5c-9200-17f0667c4adf","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-28T00:25:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"eb454838-1da9-4f5c-9200-17f0667c4adf","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-28T00:25:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a5a50dd9-6e86-42f5-829e-20c149f772aa","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:54654","PortSpecifier":{"PortValue":54654}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a5a50dd9-6e86-42f5-829e-20c149f772aa","method":"POST","path":"/ai-tenant-e2e-shared-a-328ef1/rate-test-model-328ef1/v1/completions","host":"e2e-shared-a-328ef1.apps.e05eeaa2-7b56-4c28-a8df-162e45941c70.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-28T00:25:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a5a50dd9-6e86-42f5-829e-20c149f772aa","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:54654","PortSpecifier":{"PortValue":54654}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785198338,"nanos":186569579},"http":{"id":"a5a50dd9-6e86-42f5-829e-20c149f772aa","method":"POST","headers":{":authority":"e2e-shared-a-328ef1.apps.e05eeaa2-7b56-4c28-a8df-162e45941c70.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-328ef1/rate-test-model-328ef1/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T00:25:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a5a50dd9-6e86-42f5-829e-20c149f772aa","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-6TocLW4wuGxGkSdh_wlIaJwDSUj7p9G43GaSlQV1zuYAobyCCzjOTfgTBZ84"}
{"level":"debug","ts":"2026-07-28T00:25:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a5a50dd9-6e86-42f5-829e-20c149f772aa","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-328ef1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-6TocLW4wuGxGkSdh_wlIaJwDSUj7p9G43GaSlQV1zuYAobyCCzjOTfgTBZ84\"}"}
{"level":"debug","ts":"2026-07-28T00:25:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a5a50dd9-6e86-42f5-829e-20c149f772aa","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-328ef1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"4bf04f49-f4b5-4302-86c4-905545c533f6","keyName":"e2e-rate-a-9fd842","subscription":"e2e-rate-iso-a-9fd842","tenant":"e2e-shared-a-328ef1","userId":"4bf04f49-f4b5-4302-86c4-905545c533f6","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-28T00:25:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a5a50dd9-6e86-42f5-829e-20c149f772aa","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-328ef1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-328ef1/rate-test-model-328ef1\",\"requestedSubscription\":\"e2e-rate-iso-a-9fd842\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-28T00:25:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a5a50dd9-6e86-42f5-829e-20c149f772aa","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-328ef1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-328ef1/models/facebook/opt-125m","name":"rate-test-model-328ef1","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-9fd842","namespace":"ai-tenant-e2e-shared-a-328ef1","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-328ef1/rate-test-model-328ef1"}}
{"level":"debug","ts":"2026-07-28T00:25:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a5a50dd9-6e86-42f5-829e-20c149f772aa","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T00:25:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a5a50dd9-6e86-42f5-829e-20c149f772aa","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T00:25:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a5a50dd9-6e86-42f5-829e-20c149f772aa","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T00:25:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a5a50dd9-6e86-42f5-829e-20c149f772aa","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-328ef1/rate-test-model-328ef1\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-328ef1/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T00:25:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a5a50dd9-6e86-42f5-829e-20c149f772aa","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T00:25:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a5a50dd9-6e86-42f5-829e-20c149f772aa","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-28T00:25:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a5a50dd9-6e86-42f5-829e-20c149f772aa","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-28T00:25:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a5a50dd9-6e86-42f5-829e-20c149f772aa","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-9fd842"}
{"level":"debug","ts":"2026-07-28T00:25:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a5a50dd9-6e86-42f5-829e-20c149f772aa","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"4bf04f49-f4b5-4302-86c4-905545c533f6","keyName":"e2e-rate-a-9fd842","selected_subscription":"e2e-rate-iso-a-9fd842","selected_subscription_key":"ai-tenant-e2e-shared-a-328ef1/e2e-rate-iso-a-9fd842@ai-tenant-e2e-shared-a-328ef1/rate-test-model-328ef1","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-328ef1/models/facebook/opt-125m","name":"rate-test-model-328ef1","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-9fd842","namespace":"ai-tenant-e2e-shared-a-328ef1","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-328ef1/rate-test-model-328ef1"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-28T00:25:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a5a50dd9-6e86-42f5-829e-20c149f772aa","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-28T00:25:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a5a50dd9-6e86-42f5-829e-20c149f772aa","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-28T00:25:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1373afe6-e850-4676-ad32-ebfafbbbfb0c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:54668","PortSpecifier":{"PortValue":54668}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1373afe6-e850-4676-ad32-ebfafbbbfb0c","method":"POST","path":"/ai-tenant-e2e-shared-a-328ef1/rate-test-model-328ef1/v1/completions","host":"e2e-shared-a-328ef1.apps.e05eeaa2-7b56-4c28-a8df-162e45941c70.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-28T00:25:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1373afe6-e850-4676-ad32-ebfafbbbfb0c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:54668","PortSpecifier":{"PortValue":54668}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785198339,"nanos":225484331},"http":{"id":"1373afe6-e850-4676-ad32-ebfafbbbfb0c","method":"POST","headers":{":authority":"e2e-shared-a-328ef1.apps.e05eeaa2-7b56-4c28-a8df-162e45941c70.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-328ef1/rate-test-model-328ef1/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T00:25:39Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1373afe6-e850-4676-ad32-ebfafbbbfb0c","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-6TocLW4wuGxGkSdh_wlIaJwDSUj7p9G43GaSlQV1zuYAobyCCzjOTfgTBZ84"}
{"level":"debug","ts":"2026-07-28T00:25:39Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1373afe6-e850-4676-ad32-ebfafbbbfb0c","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-328ef1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-6TocLW4wuGxGkSdh_wlIaJwDSUj7p9G43GaSlQV1zuYAobyCCzjOTfgTBZ84\"}"}
{"level":"debug","ts":"2026-07-28T00:25:39Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1373afe6-e850-4676-ad32-ebfafbbbfb0c","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-328ef1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"4bf04f49-f4b5-4302-86c4-905545c533f6","keyName":"e2e-rate-a-9fd842","subscription":"e2e-rate-iso-a-9fd842","tenant":"e2e-shared-a-328ef1","userId":"4bf04f49-f4b5-4302-86c4-905545c533f6","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-28T00:25:39Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1373afe6-e850-4676-ad32-ebfafbbbfb0c","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-328ef1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-328ef1/rate-test-model-328ef1\",\"requestedSubscription\":\"e2e-rate-iso-a-9fd842\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-28T00:25:39Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1373afe6-e850-4676-ad32-ebfafbbbfb0c","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-328ef1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-328ef1/models/facebook/opt-125m","name":"rate-test-model-328ef1","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-9fd842","namespace":"ai-tenant-e2e-shared-a-328ef1","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-328ef1/rate-test-model-328ef1"}}
{"level":"debug","ts":"2026-07-28T00:25:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1373afe6-e850-4676-ad32-ebfafbbbfb0c","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T00:25:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1373afe6-e850-4676-ad32-ebfafbbbfb0c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T00:25:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1373afe6-e850-4676-ad32-ebfafbbbfb0c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-328ef1/rate-test-model-328ef1\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-328ef1/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T00:25:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1373afe6-e850-4676-ad32-ebfafbbbfb0c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T00:25:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1373afe6-e850-4676-ad32-ebfafbbbfb0c","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T00:25:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1373afe6-e850-4676-ad32-ebfafbbbfb0c","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-28T00:25:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1373afe6-e850-4676-ad32-ebfafbbbfb0c","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-28T00:25:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1373afe6-e850-4676-ad32-ebfafbbbfb0c","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-9fd842"}
{"level":"debug","ts":"2026-07-28T00:25:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1373afe6-e850-4676-ad32-ebfafbbbfb0c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"4bf04f49-f4b5-4302-86c4-905545c533f6","keyName":"e2e-rate-a-9fd842","selected_subscription":"e2e-rate-iso-a-9fd842","selected_subscription_key":"ai-tenant-e2e-shared-a-328ef1/e2e-rate-iso-a-9fd842@ai-tenant-e2e-shared-a-328ef1/rate-test-model-328ef1","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-328ef1/models/facebook/opt-125m","name":"rate-test-model-328ef1","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-9fd842","namespace":"ai-tenant-e2e-shared-a-328ef1","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-328ef1/rate-test-model-328ef1"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-28T00:25:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1373afe6-e850-4676-ad32-ebfafbbbfb0c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-28T00:25:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1373afe6-e850-4676-ad32-ebfafbbbfb0c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-28T00:25:40Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b5d63952-9cec-4cb4-8978-8b3e4a9eb595","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:54678","PortSpecifier":{"PortValue":54678}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b5d63952-9cec-4cb4-8978-8b3e4a9eb595","method":"POST","path":"/ai-tenant-e2e-shared-a-328ef1/rate-test-model-328ef1/v1/completions","host":"e2e-shared-a-328ef1.apps.e05eeaa2-7b56-4c28-a8df-162e45941c70.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-28T00:25:40Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b5d63952-9cec-4cb4-8978-8b3e4a9eb595","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:54678","PortSpecifier":{"PortValue":54678}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785198340,"nanos":265924051},"http":{"id":"b5d63952-9cec-4cb4-8978-8b3e4a9eb595","method":"POST","headers":{":authority":"e2e-shared-a-328ef1.apps.e05eeaa2-7b56-4c28-a8df-162e45941c70.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-328ef1/rate-test-model-328ef1/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T00:25:40Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b5d63952-9cec-4cb4-8978-8b3e4a9eb595","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-6TocLW4wuGxGkSdh_wlIaJwDSUj7p9G43GaSlQV1zuYAobyCCzjOTfgTBZ84"}
{"level":"debug","ts":"2026-07-28T00:25:40Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b5d63952-9cec-4cb4-8978-8b3e4a9eb595","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-328ef1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-6TocLW4wuGxGkSdh_wlIaJwDSUj7p9G43GaSlQV1zuYAobyCCzjOTfgTBZ84\"}"}
{"level":"debug","ts":"2026-07-28T00:25:40Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b5d63952-9cec-4cb4-8978-8b3e4a9eb595","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-328ef1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"4bf04f49-f4b5-4302-86c4-905545c533f6","keyName":"e2e-rate-a-9fd842","subscription":"e2e-rate-iso-a-9fd842","tenant":"e2e-shared-a-328ef1","userId":"4bf04f49-f4b5-4302-86c4-905545c533f6","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-28T00:25:40Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b5d63952-9cec-4cb4-8978-8b3e4a9eb595","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-328ef1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-328ef1/rate-test-model-328ef1\",\"requestedSubscription\":\"e2e-rate-iso-a-9fd842\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-28T00:25:40Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b5d63952-9cec-4cb4-8978-8b3e4a9eb595","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-328ef1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-328ef1/models/facebook/opt-125m","name":"rate-test-model-328ef1","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-9fd842","namespace":"ai-tenant-e2e-shared-a-328ef1","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-328ef1/rate-test-model-328ef1"}}
{"level":"debug","ts":"2026-07-28T00:25:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b5d63952-9cec-4cb4-8978-8b3e4a9eb595","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T00:25:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b5d63952-9cec-4cb4-8978-8b3e4a9eb595","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T00:25:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b5d63952-9cec-4cb4-8978-8b3e4a9eb595","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T00:25:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b5d63952-9cec-4cb4-8978-8b3e4a9eb595","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T00:25:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b5d63952-9cec-4cb4-8978-8b3e4a9eb595","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-328ef1/rate-test-model-328ef1\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-328ef1/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T00:25:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b5d63952-9cec-4cb4-8978-8b3e4a9eb595","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-9fd842"}
{"level":"debug","ts":"2026-07-28T00:25:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b5d63952-9cec-4cb4-8978-8b3e4a9eb595","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-28T00:25:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b5d63952-9cec-4cb4-8978-8b3e4a9eb595","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-28T00:25:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b5d63952-9cec-4cb4-8978-8b3e4a9eb595","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"4bf04f49-f4b5-4302-86c4-905545c533f6","keyName":"e2e-rate-a-9fd842","selected_subscription":"e2e-rate-iso-a-9fd842","selected_subscription_key":"ai-tenant-e2e-shared-a-328ef1/e2e-rate-iso-a-9fd842@ai-tenant-e2e-shared-a-328ef1/rate-test-model-328ef1","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-328ef1/models/facebook/opt-125m","name":"rate-test-model-328ef1","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-9fd842","namespace":"ai-tenant-e2e-shared-a-328ef1","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-328ef1/rate-test-model-328ef1"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-28T00:25:40Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b5d63952-9cec-4cb4-8978-8b3e4a9eb595","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-28T00:25:40Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b5d63952-9cec-4cb4-8978-8b3e4a9eb595","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-28T00:25:41Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3ff5ce9e-1b29-4547-bca8-a9cc571a973b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:54682","PortSpecifier":{"PortValue":54682}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3ff5ce9e-1b29-4547-bca8-a9cc571a973b","method":"POST","path":"/ai-tenant-e2e-shared-a-328ef1/rate-test-model-328ef1/v1/completions","host":"e2e-shared-a-328ef1.apps.e05eeaa2-7b56-4c28-a8df-162e45941c70.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-28T00:25:41Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3ff5ce9e-1b29-4547-bca8-a9cc571a973b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:54682","PortSpecifier":{"PortValue":54682}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785198341,"nanos":303589823},"http":{"id":"3ff5ce9e-1b29-4547-bca8-a9cc571a973b","method":"POST","headers":{":authority":"e2e-shared-a-328ef1.apps.e05eeaa2-7b56-4c28-a8df-162e45941c70.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-328ef1/rate-test-model-328ef1/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T00:25:41Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3ff5ce9e-1b29-4547-bca8-a9cc571a973b","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-6TocLW4wuGxGkSdh_wlIaJwDSUj7p9G43GaSlQV1zuYAobyCCzjOTfgTBZ84"}
{"level":"debug","ts":"2026-07-28T00:25:41Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3ff5ce9e-1b29-4547-bca8-a9cc571a973b","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-328ef1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-6TocLW4wuGxGkSdh_wlIaJwDSUj7p9G43GaSlQV1zuYAobyCCzjOTfgTBZ84\"}"}
{"level":"debug","ts":"2026-07-28T00:25:41Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3ff5ce9e-1b29-4547-bca8-a9cc571a973b","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-328ef1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"4bf04f49-f4b5-4302-86c4-905545c533f6","keyName":"e2e-rate-a-9fd842","subscription":"e2e-rate-iso-a-9fd842","tenant":"e2e-shared-a-328ef1","userId":"4bf04f49-f4b5-4302-86c4-905545c533f6","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-28T00:25:41Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3ff5ce9e-1b29-4547-bca8-a9cc571a973b","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-328ef1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-328ef1/rate-test-model-328ef1\",\"requestedSubscription\":\"e2e-rate-iso-a-9fd842\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-28T00:25:41Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3ff5ce9e-1b29-4547-bca8-a9cc571a973b","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-328ef1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-328ef1/models/facebook/opt-125m","name":"rate-test-model-328ef1","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-9fd842","namespace":"ai-tenant-e2e-shared-a-328ef1","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-328ef1/rate-test-model-328ef1"}}
{"level":"debug","ts":"2026-07-28T00:25:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3ff5ce9e-1b29-4547-bca8-a9cc571a973b","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T00:25:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3ff5ce9e-1b29-4547-bca8-a9cc571a973b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T00:25:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3ff5ce9e-1b29-4547-bca8-a9cc571a973b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T00:25:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3ff5ce9e-1b29-4547-bca8-a9cc571a973b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-328ef1/rate-test-model-328ef1\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-328ef1/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T00:25:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3ff5ce9e-1b29-4547-bca8-a9cc571a973b","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T00:25:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3ff5ce9e-1b29-4547-bca8-a9cc571a973b","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-28T00:25:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3ff5ce9e-1b29-4547-bca8-a9cc571a973b","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-28T00:25:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3ff5ce9e-1b29-4547-bca8-a9cc571a973b","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-9fd842"}
{"level":"debug","ts":"2026-07-28T00:25:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3ff5ce9e-1b29-4547-bca8-a9cc571a973b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"4bf04f49-f4b5-4302-86c4-905545c533f6","keyName":"e2e-rate-a-9fd842","selected_subscription":"e2e-rate-iso-a-9fd842","selected_subscription_key":"ai-tenant-e2e-shared-a-328ef1/e2e-rate-iso-a-9fd842@ai-tenant-e2e-shared-a-328ef1/rate-test-model-328ef1","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-328ef1/models/facebook/opt-125m","name":"rate-test-model-328ef1","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-9fd842","namespace":"ai-tenant-e2e-shared-a-328ef1","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-328ef1/rate-test-model-328ef1"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-28T00:25:41Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3ff5ce9e-1b29-4547-bca8-a9cc571a973b","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-28T00:25:41Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3ff5ce9e-1b29-4547-bca8-a9cc571a973b","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-28T00:25:41Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"633dfcd0-3922-4701-b312-7d7c1a91a1c2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:47780","PortSpecifier":{"PortValue":47780}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"633dfcd0-3922-4701-b312-7d7c1a91a1c2","method":"POST","path":"/ai-tenant-e2e-shared-b-6e175a/rate-test-model-6e175a/v1/completions","host":"e2e-shared-b-6e175a.apps.e05eeaa2-7b56-4c28-a8df-162e45941c70.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-28T00:25:41Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"633dfcd0-3922-4701-b312-7d7c1a91a1c2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:47780","PortSpecifier":{"PortValue":47780}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785198341,"nanos":348942512},"http":{"id":"633dfcd0-3922-4701-b312-7d7c1a91a1c2","method":"POST","headers":{":authority":"e2e-shared-b-6e175a.apps.e05eeaa2-7b56-4c28-a8df-162e45941c70.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-6e175a/rate-test-model-6e175a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T00:25:41Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"633dfcd0-3922-4701-b312-7d7c1a91a1c2","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-HF7xL2rsAxAMICnl_7KjTIr1rezIt8ndlUISAWuLxI6pJVUMJyOUmDojj91m"}
{"level":"debug","ts":"2026-07-28T00:25:41Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"633dfcd0-3922-4701-b312-7d7c1a91a1c2","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-6e175a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-HF7xL2rsAxAMICnl_7KjTIr1rezIt8ndlUISAWuLxI6pJVUMJyOUmDojj91m\"}"}
{"level":"debug","ts":"2026-07-28T00:25:41Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"633dfcd0-3922-4701-b312-7d7c1a91a1c2","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-6e175a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"b05df403-7dba-4ab2-bbce-20b912951b7f","keyName":"e2e-rate-b-9fd842","subscription":"e2e-rate-iso-b-9fd842","tenant":"e2e-shared-b-6e175a","userId":"b05df403-7dba-4ab2-bbce-20b912951b7f","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-28T00:25:41Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"633dfcd0-3922-4701-b312-7d7c1a91a1c2","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-6e175a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-6e175a/rate-test-model-6e175a\",\"requestedSubscription\":\"e2e-rate-iso-b-9fd842\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-28T00:25:41Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"633dfcd0-3922-4701-b312-7d7c1a91a1c2","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-6e175a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-b-6e175a/models/facebook/opt-125m","name":"rate-test-model-6e175a","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-9fd842","namespace":"ai-tenant-e2e-shared-b-6e175a","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-b-6e175a/rate-test-model-6e175a"}}
{"level":"debug","ts":"2026-07-28T00:25:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"633dfcd0-3922-4701-b312-7d7c1a91a1c2","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T00:25:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"633dfcd0-3922-4701-b312-7d7c1a91a1c2","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T00:25:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"633dfcd0-3922-4701-b312-7d7c1a91a1c2","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T00:25:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"633dfcd0-3922-4701-b312-7d7c1a91a1c2","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T00:25:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"633dfcd0-3922-4701-b312-7d7c1a91a1c2","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-6e175a/rate-test-model-6e175a\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-6e175a/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T00:25:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"633dfcd0-3922-4701-b312-7d7c1a91a1c2","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-9fd842"}
{"level":"debug","ts":"2026-07-28T00:25:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"633dfcd0-3922-4701-b312-7d7c1a91a1c2","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-28T00:25:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"633dfcd0-3922-4701-b312-7d7c1a91a1c2","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-28T00:25:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"633dfcd0-3922-4701-b312-7d7c1a91a1c2","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"b05df403-7dba-4ab2-bbce-20b912951b7f","keyName":"e2e-rate-b-9fd842","selected_subscription":"e2e-rate-iso-b-9fd842","selected_subscription_key":"ai-tenant-e2e-shared-b-6e175a/e2e-rate-iso-b-9fd842@ai-tenant-e2e-shared-b-6e175a/rate-test-model-6e175a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-b-6e175a/models/facebook/opt-125m","name":"rate-test-model-6e175a","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-9fd842","namespace":"ai-tenant-e2e-shared-b-6e175a","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-b-6e175a/rate-test-model-6e175a"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-28T00:25:41Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"633dfcd0-3922-4701-b312-7d7c1a91a1c2","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-28T00:25:41Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"633dfcd0-3922-4701-b312-7d7c1a91a1c2","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-28T00:25:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2395f60a953427af8e1bc40e3515be5cb15a15536e75584c5fad9542be2e8268"}
{"level":"info","ts":"2026-07-28T00:25:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/75db2acf88b5890097fccdeb411aed4829f2f5e130a74f8f78db19f716ad298f"}
{"level":"info","ts":"2026-07-28T00:25:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/60d35aa96eafc70e0055d29d7dee387f209c0bb2e0291857d86867b2691c255a"}
{"level":"info","ts":"2026-07-28T00:25:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/46a8bc4db16d683fa2ce66ea99a969791038841ad369e6903783f51f25299bce"}
{"level":"info","ts":"2026-07-28T00:25:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/dc540bac2c04386852237b0f787162376bfdf7581c4f7c783d80d4a1ab10df57"}
{"level":"info","ts":"2026-07-28T00:25:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/5a7606feac9870f38443534593796d47d059aa7eaef5362038c0d21b73f482ba"}
{"level":"info","ts":"2026-07-28T00:25:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a496c2e859f898951090b93695c0eeb58d24d2159eb4bdbb596178c9a76b386e"}
{"level":"info","ts":"2026-07-28T00:25:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/dcf86cc6da275b819212ece1c97ec9f305ded7a92de75e9ea3032faca1f14762"}
{"level":"info","ts":"2026-07-28T00:25:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/0056c1a0791cddd7151cc42770fa1149bc2c5d2c6e50aeb197a5dc4978a0767f"}
{"level":"info","ts":"2026-07-28T00:25:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4135def1664b41f19512949c4dd9dc8a8ff03d22f35f03422f68346886bd832c"}
{"level":"info","ts":"2026-07-28T00:25:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e41013a9a65194770b1765682afb7e3e54a0fd6b2bdc764085e627b4233beab2"}
{"level":"info","ts":"2026-07-28T00:25:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/560ee7266c0e6acc18f137c577fb0d40b032b9fee10285506138c763a5cb08ca"}
{"level":"info","ts":"2026-07-28T00:25:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/cd45accca39aab0a28cd755d50aaf1047dda38233f80e73e40bbcb2739cfa770"}
{"level":"info","ts":"2026-07-28T00:25:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c17e8195a13eb5f060d9ea517129a33053f2ad2d9eb708d2619b3ee66b49535d"}
{"level":"info","ts":"2026-07-28T00:25:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/827622361627e81308389adfe4d9f1f7cea2559d5cbef6593a378b2fc32619c6"}
{"level":"info","ts":"2026-07-28T00:25:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/303c5f46bef56e84f00cbc203e48d582f62c53fbbcc0ec4d66d88df43466ef19"}
{"level":"info","ts":"2026-07-28T00:25:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/728a18f6727845ffe36516eff2be5fadbfa0f92c150979d3baaab4bf25fe66d8"}
{"level":"info","ts":"2026-07-28T00:25:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/61c7eca1c50a1019c079c99594f6ecc5fc2dd13fe71813193c5f1aa84c602738"}
{"level":"info","ts":"2026-07-28T00:25:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/96fd38f71e644a9464f169cf5290c7017cab60bf0efd0f887f622756df042333"}
{"level":"info","ts":"2026-07-28T00:25:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e2fc9da14afdf6e7daf780ca20dcdfcc235f8f0093f384f837ce1e1145e297fe"}
{"level":"info","ts":"2026-07-28T00:25:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/0f932a54f1ae3e6cd2ecd2f3d1638054a2b876c0edd101b12253e08fb2e83f53"}
{"level":"info","ts":"2026-07-28T00:25:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d5c2a694c80a3d770c60e185c7f8dba6823053e111c14f677bb80ae459270cde"}
{"level":"info","ts":"2026-07-28T00:25:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b640db3fa51b99325612fe56eb22120f0b45833697c52f240764c85de2ff2a73"}
{"level":"info","ts":"2026-07-28T00:25:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/8ce3da6562095655fa6a1696a605f4ebb73b293d3a5937964b79a391de2d5948"}
{"level":"info","ts":"2026-07-28T00:26:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b2792784-c7e8-4b0c-ba98-1e633d6aa0b0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53894","PortSpecifier":{"PortValue":53894}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.36:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b2792784-c7e8-4b0c-ba98-1e633d6aa0b0","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.e05eeaa2-7b56-4c28-a8df-162e45941c70.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-28T00:26:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b2792784-c7e8-4b0c-ba98-1e633d6aa0b0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53894","PortSpecifier":{"PortValue":53894}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.36:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785198405,"nanos":110354091},"http":{"id":"b2792784-c7e8-4b0c-ba98-1e633d6aa0b0","method":"POST","headers":{":authority":"maas.apps.e05eeaa2-7b56-4c28-a8df-162e45941c70.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T00:26:45Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"b2792784-c7e8-4b0c-ba98-1e633d6aa0b0","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-28T00:26:45Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b2792784-c7e8-4b0c-ba98-1e633d6aa0b0","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"f9d7f23f-32ca-4538-885d-5aa75ccad317","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=ac1bf6b3-1074-4597-a671-32089a71fe68"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/162e45941c70"]}}
{"level":"debug","ts":"2026-07-28T00:26:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b2792784-c7e8-4b0c-ba98-1e633d6aa0b0","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/162e45941c70"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=ac1bf6b3-1074-4597-a671-32089a71fe68"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"f9d7f23f-32ca-4538-885d-5aa75ccad317","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.36:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.e05eeaa2-7b56-4c28-a8df-162e45941c70.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T00:26:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b2792784-c7e8-4b0c-ba98-1e633d6aa0b0","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T00:26:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b2792784-c7e8-4b0c-ba98-1e633d6aa0b0","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T00:26:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b2792784-c7e8-4b0c-ba98-1e633d6aa0b0","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]},\"publishers/llm/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/llm/models/facebook/opt-125m-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T00:26:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"b2792784-c7e8-4b0c-ba98-1e633d6aa0b0","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-28T00:26:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b2792784-c7e8-4b0c-ba98-1e633d6aa0b0","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-28T00:26:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b2792784-c7e8-4b0c-ba98-1e633d6aa0b0","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-28T00:26:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b2792784-c7e8-4b0c-ba98-1e633d6aa0b0","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-28T00:26:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b2792784-c7e8-4b0c-ba98-1e633d6aa0b0","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-28T00:26:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"338d2562-9100-48e2-ac3b-72f8cdac6086","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53898","PortSpecifier":{"PortValue":53898}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.36:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"338d2562-9100-48e2-ac3b-72f8cdac6086","method":"POST","path":"/llm/facebook-opt-125m-simulated/v1/chat/completions","host":"maas.apps.e05eeaa2-7b56-4c28-a8df-162e45941c70.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-28T00:26:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"338d2562-9100-48e2-ac3b-72f8cdac6086","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:53898","PortSpecifier":{"PortValue":53898}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.36:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785198405,"nanos":167836951},"http":{"id":"338d2562-9100-48e2-ac3b-72f8cdac6086","method":"POST","headers":{":authority":"maas.apps.e05eeaa2-7b56-4c28-a8df-162e45941c70.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T00:26:45Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"338d2562-9100-48e2-ac3b-72f8cdac6086","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-nRMzdRosWDec4tbP_A6GtsRU3AOzNJBoPiGRyLxchHMfBSOdLnhErPumdOv8"}
{"level":"debug","ts":"2026-07-28T00:26:45Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"338d2562-9100-48e2-ac3b-72f8cdac6086","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-nRMzdRosWDec4tbP_A6GtsRU3AOzNJBoPiGRyLxchHMfBSOdLnhErPumdOv8\"}"}
{"level":"debug","ts":"2026-07-28T00:26:45Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"338d2562-9100-48e2-ac3b-72f8cdac6086","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"5e1d71a7-421f-4f0a-a374-2d80331f9c9e","keyName":"e2e-ipp-default","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"5e1d71a7-421f-4f0a-a374-2d80331f9c9e","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-28T00:26:45Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"338d2562-9100-48e2-ac3b-72f8cdac6086","config":"subscription-info","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"simulator-subscription\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-28T00:26:45Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"338d2562-9100-48e2-ac3b-72f8cdac6086","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","model_name":"publishers/llm/models/facebook/opt-125m","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true,"resolvedModel":"llm/facebook-opt-125m-simulated"}}
{"level":"debug","ts":"2026-07-28T00:26:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"338d2562-9100-48e2-ac3b-72f8cdac6086","input":{"auth":{"identity":"Bearer **** subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","model_name":"publishers/llm/models/facebook/opt-125m","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true,"resolvedModel":"llm/facebook-opt-125m-simulated"}}},"context":{"context_extensions":{"host":"311b1be286674fd5684c9ac59b318287dade9769cfe4aeebd8c88e2dc6b72418"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.36:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.e05eeaa2-7b56-4c28-a8df-162e45941c70.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T00:26:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"338d2562-9100-48e2-ac3b-72f8cdac6086","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T00:26:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"338d2562-9100-48e2-ac3b-72f8cdac6086","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T00:26:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"338d2562-9100-48e2-ac3b-72f8cdac6086","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T00:26:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"338d2562-9100-48e2-ac3b-72f8cdac6086","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]},\"publishers/llm/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/llm/models/facebook/opt-125m-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T00:26:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"338d2562-9100-48e2-ac3b-72f8cdac6086","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-28T00:26:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"338d2562-9100-48e2-ac3b-72f8cdac6086","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-28T00:26:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"338d2562-9100-48e2-ac3b-72f8cdac6086","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-28T00:26:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"338d2562-9100-48e2-ac3b-72f8cdac6086","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"5e1d71a7-421f-4f0a-a374-2d80331f9c9e","keyName":"e2e-ipp-default","selected_subscription":"simulator-subscription","selected_subscription_key":"models-as-a-service/simulator-subscription@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","model_name":"publishers/llm/models/facebook/opt-125m","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true,"resolvedModel":"llm/facebook-opt-125m-simulated"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-28T00:26:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"338d2562-9100-48e2-ac3b-72f8cdac6086","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-28T00:26:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"338d2562-9100-48e2-ac3b-72f8cdac6086","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"509e7f4b38aad5ab58d2c2634e8e6ffe310fdc4f52c8972d5e12429b96801146","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T00:27:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T00:27:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"509e7f4b38aad5ab58d2c2634e8e6ffe310fdc4f52c8972d5e12429b96801146","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7ff94dcb7b8817e99a20069a8faaa53f5aae11d3b1703f3a7f2dee383e00a769","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T00:27:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T00:27:16Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/509e7f4b38aad5ab58d2c2634e8e6ffe310fdc4f52c8972d5e12429b96801146"}
{"level":"info","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7ff94dcb7b8817e99a20069a8faaa53f5aae11d3b1703f3a7f2dee383e00a769","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"509e7f4b38aad5ab58d2c2634e8e6ffe310fdc4f52c8972d5e12429b96801146","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T00:27:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T00:27:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["509e7f4b38aad5ab58d2c2634e8e6ffe310fdc4f52c8972d5e12429b96801146"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"509e7f4b38aad5ab58d2c2634e8e6ffe310fdc4f52c8972d5e12429b96801146","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7ff94dcb7b8817e99a20069a8faaa53f5aae11d3b1703f3a7f2dee383e00a769","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T00:27:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T00:27:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7ff94dcb7b8817e99a20069a8faaa53f5aae11d3b1703f3a7f2dee383e00a769"}
{"level":"info","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7ff94dcb7b8817e99a20069a8faaa53f5aae11d3b1703f3a7f2dee383e00a769","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"509e7f4b38aad5ab58d2c2634e8e6ffe310fdc4f52c8972d5e12429b96801146","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T00:27:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T00:27:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/509e7f4b38aad5ab58d2c2634e8e6ffe310fdc4f52c8972d5e12429b96801146"}
{"level":"info","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"509e7f4b38aad5ab58d2c2634e8e6ffe310fdc4f52c8972d5e12429b96801146","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7ff94dcb7b8817e99a20069a8faaa53f5aae11d3b1703f3a7f2dee383e00a769","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"509e7f4b38aad5ab58d2c2634e8e6ffe310fdc4f52c8972d5e12429b96801146","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T00:27:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T00:27:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["509e7f4b38aad5ab58d2c2634e8e6ffe310fdc4f52c8972d5e12429b96801146"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"509e7f4b38aad5ab58d2c2634e8e6ffe310fdc4f52c8972d5e12429b96801146","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"509e7f4b38aad5ab58d2c2634e8e6ffe310fdc4f52c8972d5e12429b96801146","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T00:27:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T00:27:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["509e7f4b38aad5ab58d2c2634e8e6ffe310fdc4f52c8972d5e12429b96801146"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"509e7f4b38aad5ab58d2c2634e8e6ffe310fdc4f52c8972d5e12429b96801146","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"509e7f4b38aad5ab58d2c2634e8e6ffe310fdc4f52c8972d5e12429b96801146\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"509e7f4b38aad5ab58d2c2634e8e6ffe310fdc4f52c8972d5e12429b96801146","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7ff94dcb7b8817e99a20069a8faaa53f5aae11d3b1703f3a7f2dee383e00a769","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7ff94dcb7b8817e99a20069a8faaa53f5aae11d3b1703f3a7f2dee383e00a769"}
{"level":"debug","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"509e7f4b38aad5ab58d2c2634e8e6ffe310fdc4f52c8972d5e12429b96801146","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T00:27:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T00:27:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"509e7f4b38aad5ab58d2c2634e8e6ffe310fdc4f52c8972d5e12429b96801146","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"509e7f4b38aad5ab58d2c2634e8e6ffe310fdc4f52c8972d5e12429b96801146","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"509e7f4b38aad5ab58d2c2634e8e6ffe310fdc4f52c8972d5e12429b96801146","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/509e7f4b38aad5ab58d2c2634e8e6ffe310fdc4f52c8972d5e12429b96801146"}
{"level":"debug","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7ff94dcb7b8817e99a20069a8faaa53f5aae11d3b1703f3a7f2dee383e00a769","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T00:27:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T00:27:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7ff94dcb7b8817e99a20069a8faaa53f5aae11d3b1703f3a7f2dee383e00a769"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/509e7f4b38aad5ab58d2c2634e8e6ffe310fdc4f52c8972d5e12429b96801146"}
{"level":"info","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7ff94dcb7b8817e99a20069a8faaa53f5aae11d3b1703f3a7f2dee383e00a769","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"509e7f4b38aad5ab58d2c2634e8e6ffe310fdc4f52c8972d5e12429b96801146","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T00:27:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T00:27:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["509e7f4b38aad5ab58d2c2634e8e6ffe310fdc4f52c8972d5e12429b96801146"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"509e7f4b38aad5ab58d2c2634e8e6ffe310fdc4f52c8972d5e12429b96801146","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7ff94dcb7b8817e99a20069a8faaa53f5aae11d3b1703f3a7f2dee383e00a769","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T00:27:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T00:27:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7ff94dcb7b8817e99a20069a8faaa53f5aae11d3b1703f3a7f2dee383e00a769"}
{"level":"info","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7ff94dcb7b8817e99a20069a8faaa53f5aae11d3b1703f3a7f2dee383e00a769","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"509e7f4b38aad5ab58d2c2634e8e6ffe310fdc4f52c8972d5e12429b96801146","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T00:27:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T00:27:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"509e7f4b38aad5ab58d2c2634e8e6ffe310fdc4f52c8972d5e12429b96801146","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7ff94dcb7b8817e99a20069a8faaa53f5aae11d3b1703f3a7f2dee383e00a769","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T00:27:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T00:27:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7ff94dcb7b8817e99a20069a8faaa53f5aae11d3b1703f3a7f2dee383e00a769"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/509e7f4b38aad5ab58d2c2634e8e6ffe310fdc4f52c8972d5e12429b96801146"}
{"level":"info","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7ff94dcb7b8817e99a20069a8faaa53f5aae11d3b1703f3a7f2dee383e00a769","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"509e7f4b38aad5ab58d2c2634e8e6ffe310fdc4f52c8972d5e12429b96801146","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T00:27:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T00:27:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["509e7f4b38aad5ab58d2c2634e8e6ffe310fdc4f52c8972d5e12429b96801146"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"509e7f4b38aad5ab58d2c2634e8e6ffe310fdc4f52c8972d5e12429b96801146","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7ff94dcb7b8817e99a20069a8faaa53f5aae11d3b1703f3a7f2dee383e00a769","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T00:27:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T00:27:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7ff94dcb7b8817e99a20069a8faaa53f5aae11d3b1703f3a7f2dee383e00a769"}
{"level":"info","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7ff94dcb7b8817e99a20069a8faaa53f5aae11d3b1703f3a7f2dee383e00a769","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"81cbae7834337c342856e36963aaaf3ffa4bf45951af89db77bc9a4cd8aa4564","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T00:27:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T00:27:16Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/509e7f4b38aad5ab58d2c2634e8e6ffe310fdc4f52c8972d5e12429b96801146"}
{"level":"info","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"81cbae7834337c342856e36963aaaf3ffa4bf45951af89db77bc9a4cd8aa4564","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"509e7f4b38aad5ab58d2c2634e8e6ffe310fdc4f52c8972d5e12429b96801146","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7ff94dcb7b8817e99a20069a8faaa53f5aae11d3b1703f3a7f2dee383e00a769","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T00:27:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T00:27:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7ff94dcb7b8817e99a20069a8faaa53f5aae11d3b1703f3a7f2dee383e00a769"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7ff94dcb7b8817e99a20069a8faaa53f5aae11d3b1703f3a7f2dee383e00a769","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"81cbae7834337c342856e36963aaaf3ffa4bf45951af89db77bc9a4cd8aa4564","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T00:27:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T00:27:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/81cbae7834337c342856e36963aaaf3ffa4bf45951af89db77bc9a4cd8aa4564"}
{"level":"info","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"81cbae7834337c342856e36963aaaf3ffa4bf45951af89db77bc9a4cd8aa4564","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7ff94dcb7b8817e99a20069a8faaa53f5aae11d3b1703f3a7f2dee383e00a769","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T00:27:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T00:27:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7ff94dcb7b8817e99a20069a8faaa53f5aae11d3b1703f3a7f2dee383e00a769","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"81cbae7834337c342856e36963aaaf3ffa4bf45951af89db77bc9a4cd8aa4564","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T00:27:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T00:27:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["81cbae7834337c342856e36963aaaf3ffa4bf45951af89db77bc9a4cd8aa4564"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7ff94dcb7b8817e99a20069a8faaa53f5aae11d3b1703f3a7f2dee383e00a769"}
{"level":"info","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"81cbae7834337c342856e36963aaaf3ffa4bf45951af89db77bc9a4cd8aa4564","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7ff94dcb7b8817e99a20069a8faaa53f5aae11d3b1703f3a7f2dee383e00a769","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T00:27:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T00:27:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7ff94dcb7b8817e99a20069a8faaa53f5aae11d3b1703f3a7f2dee383e00a769"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/81cbae7834337c342856e36963aaaf3ffa4bf45951af89db77bc9a4cd8aa4564"}
{"level":"info","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7ff94dcb7b8817e99a20069a8faaa53f5aae11d3b1703f3a7f2dee383e00a769","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"81cbae7834337c342856e36963aaaf3ffa4bf45951af89db77bc9a4cd8aa4564","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7ff94dcb7b8817e99a20069a8faaa53f5aae11d3b1703f3a7f2dee383e00a769","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T00:27:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T00:27:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7ff94dcb7b8817e99a20069a8faaa53f5aae11d3b1703f3a7f2dee383e00a769","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7ff94dcb7b8817e99a20069a8faaa53f5aae11d3b1703f3a7f2dee383e00a769","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7ff94dcb7b8817e99a20069a8faaa53f5aae11d3b1703f3a7f2dee383e00a769"}
{"level":"debug","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7ff94dcb7b8817e99a20069a8faaa53f5aae11d3b1703f3a7f2dee383e00a769","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T00:27:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T00:27:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7ff94dcb7b8817e99a20069a8faaa53f5aae11d3b1703f3a7f2dee383e00a769"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7ff94dcb7b8817e99a20069a8faaa53f5aae11d3b1703f3a7f2dee383e00a769","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7ff94dcb7b8817e99a20069a8faaa53f5aae11d3b1703f3a7f2dee383e00a769","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/81cbae7834337c342856e36963aaaf3ffa4bf45951af89db77bc9a4cd8aa4564"}
{"level":"info","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7ff94dcb7b8817e99a20069a8faaa53f5aae11d3b1703f3a7f2dee383e00a769"}
{"level":"debug","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"053335dad976aa79b23d930e0511a6651a79276e6b2a0a95a92add5a9c14312b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T00:27:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T00:27:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"053335dad976aa79b23d930e0511a6651a79276e6b2a0a95a92add5a9c14312b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"053335dad976aa79b23d930e0511a6651a79276e6b2a0a95a92add5a9c14312b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"053335dad976aa79b23d930e0511a6651a79276e6b2a0a95a92add5a9c14312b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/053335dad976aa79b23d930e0511a6651a79276e6b2a0a95a92add5a9c14312b"}
{"level":"debug","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"053335dad976aa79b23d930e0511a6651a79276e6b2a0a95a92add5a9c14312b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/053335dad976aa79b23d930e0511a6651a79276e6b2a0a95a92add5a9c14312b"}
{"level":"debug","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"053335dad976aa79b23d930e0511a6651a79276e6b2a0a95a92add5a9c14312b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T00:27:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T00:27:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["053335dad976aa79b23d930e0511a6651a79276e6b2a0a95a92add5a9c14312b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"053335dad976aa79b23d930e0511a6651a79276e6b2a0a95a92add5a9c14312b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"053335dad976aa79b23d930e0511a6651a79276e6b2a0a95a92add5a9c14312b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T00:27:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T00:27:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"053335dad976aa79b23d930e0511a6651a79276e6b2a0a95a92add5a9c14312b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"053335dad976aa79b23d930e0511a6651a79276e6b2a0a95a92add5a9c14312b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"053335dad976aa79b23d930e0511a6651a79276e6b2a0a95a92add5a9c14312b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/053335dad976aa79b23d930e0511a6651a79276e6b2a0a95a92add5a9c14312b"}
{"level":"debug","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"053335dad976aa79b23d930e0511a6651a79276e6b2a0a95a92add5a9c14312b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/053335dad976aa79b23d930e0511a6651a79276e6b2a0a95a92add5a9c14312b"}
{"level":"debug","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"053335dad976aa79b23d930e0511a6651a79276e6b2a0a95a92add5a9c14312b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T00:27:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T00:27:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["053335dad976aa79b23d930e0511a6651a79276e6b2a0a95a92add5a9c14312b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"053335dad976aa79b23d930e0511a6651a79276e6b2a0a95a92add5a9c14312b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"053335dad976aa79b23d930e0511a6651a79276e6b2a0a95a92add5a9c14312b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/053335dad976aa79b23d930e0511a6651a79276e6b2a0a95a92add5a9c14312b"}
{"level":"debug","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c0938324fab2d036aba66acd18d51e6297413259bbf3eefc75dc938d1cc426b6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T00:27:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T00:27:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c0938324fab2d036aba66acd18d51e6297413259bbf3eefc75dc938d1cc426b6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c0938324fab2d036aba66acd18d51e6297413259bbf3eefc75dc938d1cc426b6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c0938324fab2d036aba66acd18d51e6297413259bbf3eefc75dc938d1cc426b6","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c0938324fab2d036aba66acd18d51e6297413259bbf3eefc75dc938d1cc426b6"}
{"level":"debug","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c0938324fab2d036aba66acd18d51e6297413259bbf3eefc75dc938d1cc426b6","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c0938324fab2d036aba66acd18d51e6297413259bbf3eefc75dc938d1cc426b6"}
{"level":"debug","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c0938324fab2d036aba66acd18d51e6297413259bbf3eefc75dc938d1cc426b6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T00:27:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T00:27:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c0938324fab2d036aba66acd18d51e6297413259bbf3eefc75dc938d1cc426b6"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c0938324fab2d036aba66acd18d51e6297413259bbf3eefc75dc938d1cc426b6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c0938324fab2d036aba66acd18d51e6297413259bbf3eefc75dc938d1cc426b6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c8964b6b710705dec71229c975d699c0038216416ee8dfd8968d79fd07dd03d2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T00:27:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T00:27:16Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c0938324fab2d036aba66acd18d51e6297413259bbf3eefc75dc938d1cc426b6"}
{"level":"info","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c8964b6b710705dec71229c975d699c0038216416ee8dfd8968d79fd07dd03d2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c8964b6b710705dec71229c975d699c0038216416ee8dfd8968d79fd07dd03d2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T00:27:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T00:27:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c8964b6b710705dec71229c975d699c0038216416ee8dfd8968d79fd07dd03d2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c8964b6b710705dec71229c975d699c0038216416ee8dfd8968d79fd07dd03d2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T00:27:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T00:27:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c8964b6b710705dec71229c975d699c0038216416ee8dfd8968d79fd07dd03d2"}
{"level":"error","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"c8964b6b710705dec71229c975d699c0038216416ee8dfd8968d79fd07dd03d2","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"c8964b6b710705dec71229c975d699c0038216416ee8dfd8968d79fd07dd03d2\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c8964b6b710705dec71229c975d699c0038216416ee8dfd8968d79fd07dd03d2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c8964b6b710705dec71229c975d699c0038216416ee8dfd8968d79fd07dd03d2","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c8964b6b710705dec71229c975d699c0038216416ee8dfd8968d79fd07dd03d2"}
{"level":"debug","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c000117fe2485bb6d5d659cc919272f5b800abe700a16aa981bf9c5ee0279949","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T00:27:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T00:27:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c000117fe2485bb6d5d659cc919272f5b800abe700a16aa981bf9c5ee0279949","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c8964b6b710705dec71229c975d699c0038216416ee8dfd8968d79fd07dd03d2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T00:27:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T00:27:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c8964b6b710705dec71229c975d699c0038216416ee8dfd8968d79fd07dd03d2"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c000117fe2485bb6d5d659cc919272f5b800abe700a16aa981bf9c5ee0279949"}
{"level":"info","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c8964b6b710705dec71229c975d699c0038216416ee8dfd8968d79fd07dd03d2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c000117fe2485bb6d5d659cc919272f5b800abe700a16aa981bf9c5ee0279949","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c8964b6b710705dec71229c975d699c0038216416ee8dfd8968d79fd07dd03d2","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c000117fe2485bb6d5d659cc919272f5b800abe700a16aa981bf9c5ee0279949"}
{"level":"debug","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c000117fe2485bb6d5d659cc919272f5b800abe700a16aa981bf9c5ee0279949","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T00:27:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T00:27:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c000117fe2485bb6d5d659cc919272f5b800abe700a16aa981bf9c5ee0279949"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c000117fe2485bb6d5d659cc919272f5b800abe700a16aa981bf9c5ee0279949","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c000117fe2485bb6d5d659cc919272f5b800abe700a16aa981bf9c5ee0279949","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-28T00:27:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c8964b6b710705dec71229c975d699c0038216416ee8dfd8968d79fd07dd03d2"}
{"level":"info","ts":"2026-07-28T00:27:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c000117fe2485bb6d5d659cc919272f5b800abe700a16aa981bf9c5ee0279949"}
{"level":"debug","ts":"2026-07-28T00:27:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"49faa9965cbf140b362d681bcbff304a3cb93886fcc784c1394b20365fd37017","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T00:27:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T00:27:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T00:27:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"49faa9965cbf140b362d681bcbff304a3cb93886fcc784c1394b20365fd37017","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T00:27:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"49faa9965cbf140b362d681bcbff304a3cb93886fcc784c1394b20365fd37017","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T00:27:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"49faa9965cbf140b362d681bcbff304a3cb93886fcc784c1394b20365fd37017","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-28T00:27:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/49faa9965cbf140b362d681bcbff304a3cb93886fcc784c1394b20365fd37017"}
{"level":"debug","ts":"2026-07-28T00:27:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"49faa9965cbf140b362d681bcbff304a3cb93886fcc784c1394b20365fd37017","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-28T00:27:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/49faa9965cbf140b362d681bcbff304a3cb93886fcc784c1394b20365fd37017"}
{"level":"debug","ts":"2026-07-28T00:27:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"49faa9965cbf140b362d681bcbff304a3cb93886fcc784c1394b20365fd37017","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T00:27:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T00:27:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["49faa9965cbf140b362d681bcbff304a3cb93886fcc784c1394b20365fd37017"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T00:27:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"49faa9965cbf140b362d681bcbff304a3cb93886fcc784c1394b20365fd37017","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T00:27:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"49faa9965cbf140b362d681bcbff304a3cb93886fcc784c1394b20365fd37017","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T00:27:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d0b833cf883cdbee378be2dae14a78fbd2eedec48c97666daeaf4fd2ac18add1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T00:27:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T00:27:17Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T00:27:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d0b833cf883cdbee378be2dae14a78fbd2eedec48c97666daeaf4fd2ac18add1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T00:27:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"761675e7ed81e205f0d2421581524a73ef7685569997f03bae752df609626186","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T00:27:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T00:27:17Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T00:27:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/49faa9965cbf140b362d681bcbff304a3cb93886fcc784c1394b20365fd37017"}
{"level":"info","ts":"2026-07-28T00:27:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"761675e7ed81e205f0d2421581524a73ef7685569997f03bae752df609626186","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T00:27:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d0b833cf883cdbee378be2dae14a78fbd2eedec48c97666daeaf4fd2ac18add1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T00:27:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T00:27:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T00:27:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d0b833cf883cdbee378be2dae14a78fbd2eedec48c97666daeaf4fd2ac18add1"}
{"level":"info","ts":"2026-07-28T00:27:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d0b833cf883cdbee378be2dae14a78fbd2eedec48c97666daeaf4fd2ac18add1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T00:27:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"761675e7ed81e205f0d2421581524a73ef7685569997f03bae752df609626186","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T00:27:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T00:27:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T00:27:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/761675e7ed81e205f0d2421581524a73ef7685569997f03bae752df609626186"}
{"level":"info","ts":"2026-07-28T00:27:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"761675e7ed81e205f0d2421581524a73ef7685569997f03bae752df609626186","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T00:27:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d0b833cf883cdbee378be2dae14a78fbd2eedec48c97666daeaf4fd2ac18add1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T00:27:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"761675e7ed81e205f0d2421581524a73ef7685569997f03bae752df609626186","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T00:27:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T00:27:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["761675e7ed81e205f0d2421581524a73ef7685569997f03bae752df609626186"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T00:27:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"761675e7ed81e205f0d2421581524a73ef7685569997f03bae752df609626186","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T00:27:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"761675e7ed81e205f0d2421581524a73ef7685569997f03bae752df609626186","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T00:27:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T00:27:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["761675e7ed81e205f0d2421581524a73ef7685569997f03bae752df609626186"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T00:27:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d0b833cf883cdbee378be2dae14a78fbd2eedec48c97666daeaf4fd2ac18add1"}
{"level":"error","ts":"2026-07-28T00:27:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"761675e7ed81e205f0d2421581524a73ef7685569997f03bae752df609626186","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"761675e7ed81e205f0d2421581524a73ef7685569997f03bae752df609626186\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-28T00:27:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d0b833cf883cdbee378be2dae14a78fbd2eedec48c97666daeaf4fd2ac18add1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T00:27:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T00:27:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d0b833cf883cdbee378be2dae14a78fbd2eedec48c97666daeaf4fd2ac18add1"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T00:27:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d0b833cf883cdbee378be2dae14a78fbd2eedec48c97666daeaf4fd2ac18add1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T00:27:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"761675e7ed81e205f0d2421581524a73ef7685569997f03bae752df609626186","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T00:27:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T00:27:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T00:27:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/761675e7ed81e205f0d2421581524a73ef7685569997f03bae752df609626186"}
{"level":"info","ts":"2026-07-28T00:27:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"761675e7ed81e205f0d2421581524a73ef7685569997f03bae752df609626186","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T00:27:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d0b833cf883cdbee378be2dae14a78fbd2eedec48c97666daeaf4fd2ac18add1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T00:27:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T00:27:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T00:27:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d0b833cf883cdbee378be2dae14a78fbd2eedec48c97666daeaf4fd2ac18add1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T00:27:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a0f77829d597a550f30847d5ed17baaa0ad0da88d1a11bde7dbd5fcee202a976","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T00:27:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T00:27:17Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T00:27:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a0f77829d597a550f30847d5ed17baaa0ad0da88d1a11bde7dbd5fcee202a976","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T00:27:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"761675e7ed81e205f0d2421581524a73ef7685569997f03bae752df609626186","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T00:27:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T00:27:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["761675e7ed81e205f0d2421581524a73ef7685569997f03bae752df609626186"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T00:27:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d0b833cf883cdbee378be2dae14a78fbd2eedec48c97666daeaf4fd2ac18add1"}
{"level":"info","ts":"2026-07-28T00:27:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"761675e7ed81e205f0d2421581524a73ef7685569997f03bae752df609626186","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T00:27:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f3cda189d3e6578dffd705397b8f7436ab983556ff5f1fc24e27e085693593fa","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T00:27:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T00:27:17Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T00:27:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f3cda189d3e6578dffd705397b8f7436ab983556ff5f1fc24e27e085693593fa","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T00:27:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d0b833cf883cdbee378be2dae14a78fbd2eedec48c97666daeaf4fd2ac18add1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T00:27:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T00:27:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d0b833cf883cdbee378be2dae14a78fbd2eedec48c97666daeaf4fd2ac18add1"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T00:27:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d0b833cf883cdbee378be2dae14a78fbd2eedec48c97666daeaf4fd2ac18add1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T00:27:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a0f77829d597a550f30847d5ed17baaa0ad0da88d1a11bde7dbd5fcee202a976","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T00:27:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T00:27:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T00:27:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a0f77829d597a550f30847d5ed17baaa0ad0da88d1a11bde7dbd5fcee202a976"}
{"level":"info","ts":"2026-07-28T00:27:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a0f77829d597a550f30847d5ed17baaa0ad0da88d1a11bde7dbd5fcee202a976","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T00:27:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"761675e7ed81e205f0d2421581524a73ef7685569997f03bae752df609626186","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T00:27:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T00:27:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T00:27:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"761675e7ed81e205f0d2421581524a73ef7685569997f03bae752df609626186","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T00:27:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f3cda189d3e6578dffd705397b8f7436ab983556ff5f1fc24e27e085693593fa","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T00:27:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d0b833cf883cdbee378be2dae14a78fbd2eedec48c97666daeaf4fd2ac18add1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T00:27:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a0f77829d597a550f30847d5ed17baaa0ad0da88d1a11bde7dbd5fcee202a976","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T00:27:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T00:27:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a0f77829d597a550f30847d5ed17baaa0ad0da88d1a11bde7dbd5fcee202a976"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T00:27:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/761675e7ed81e205f0d2421581524a73ef7685569997f03bae752df609626186"}
{"level":"info","ts":"2026-07-28T00:27:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a0f77829d597a550f30847d5ed17baaa0ad0da88d1a11bde7dbd5fcee202a976","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T00:27:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"761675e7ed81e205f0d2421581524a73ef7685569997f03bae752df609626186","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T00:27:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T00:27:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["761675e7ed81e205f0d2421581524a73ef7685569997f03bae752df609626186"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T00:27:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f3cda189d3e6578dffd705397b8f7436ab983556ff5f1fc24e27e085693593fa"}
{"level":"info","ts":"2026-07-28T00:27:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"761675e7ed81e205f0d2421581524a73ef7685569997f03bae752df609626186","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T00:27:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f3cda189d3e6578dffd705397b8f7436ab983556ff5f1fc24e27e085693593fa","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T00:27:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T00:27:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["f3cda189d3e6578dffd705397b8f7436ab983556ff5f1fc24e27e085693593fa"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T00:27:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f3cda189d3e6578dffd705397b8f7436ab983556ff5f1fc24e27e085693593fa","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T00:27:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a0f77829d597a550f30847d5ed17baaa0ad0da88d1a11bde7dbd5fcee202a976","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T00:27:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"761675e7ed81e205f0d2421581524a73ef7685569997f03bae752df609626186","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T00:27:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f3cda189d3e6578dffd705397b8f7436ab983556ff5f1fc24e27e085693593fa","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-28T00:27:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d0b833cf883cdbee378be2dae14a78fbd2eedec48c97666daeaf4fd2ac18add1"}
{"level":"info","ts":"2026-07-28T00:27:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a0f77829d597a550f30847d5ed17baaa0ad0da88d1a11bde7dbd5fcee202a976"}
{"level":"info","ts":"2026-07-28T00:27:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/761675e7ed81e205f0d2421581524a73ef7685569997f03bae752df609626186"}
{"level":"info","ts":"2026-07-28T00:27:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f3cda189d3e6578dffd705397b8f7436ab983556ff5f1fc24e27e085693593fa"}
{"level":"info","ts":"2026-07-28T00:27:40Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ee470860-2477-4ba8-b30a-91beede71732","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:47084","PortSpecifier":{"PortValue":47084}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ee470860-2477-4ba8-b30a-91beede71732","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-ipp-a-74721a.apps.e05eeaa2-7b56-4c28-a8df-162e45941c70.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-28T00:27:40Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ee470860-2477-4ba8-b30a-91beede71732","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:47084","PortSpecifier":{"PortValue":47084}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785198460,"nanos":426935284},"http":{"id":"ee470860-2477-4ba8-b30a-91beede71732","method":"POST","headers":{":authority":"e2e-ipp-a-74721a.apps.e05eeaa2-7b56-4c28-a8df-162e45941c70.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T00:27:40Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"ee470860-2477-4ba8-b30a-91beede71732","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-28T00:27:40Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ee470860-2477-4ba8-b30a-91beede71732","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"f9d7f23f-32ca-4538-885d-5aa75ccad317","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=ac1bf6b3-1074-4597-a671-32089a71fe68"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/162e45941c70"]}}
{"level":"debug","ts":"2026-07-28T00:27:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ee470860-2477-4ba8-b30a-91beede71732","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/162e45941c70"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=ac1bf6b3-1074-4597-a671-32089a71fe68"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"f9d7f23f-32ca-4538-885d-5aa75ccad317","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"053335dad976aa79b23d930e0511a6651a79276e6b2a0a95a92add5a9c14312b"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.55:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-ipp-a-74721a.apps.e05eeaa2-7b56-4c28-a8df-162e45941c70.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T00:27:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ee470860-2477-4ba8-b30a-91beede71732","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T00:27:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ee470860-2477-4ba8-b30a-91beede71732","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T00:27:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ee470860-2477-4ba8-b30a-91beede71732","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-ipp-a-74721a/ipp-route-74721a\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-ipp-a-74721a/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T00:27:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"ee470860-2477-4ba8-b30a-91beede71732","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-28T00:27:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ee470860-2477-4ba8-b30a-91beede71732","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-28T00:27:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ee470860-2477-4ba8-b30a-91beede71732","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-28T00:27:40Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ee470860-2477-4ba8-b30a-91beede71732","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-28T00:27:40Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ee470860-2477-4ba8-b30a-91beede71732","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-28T00:27:42Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f64c2158-c8e3-442f-a42f-e60497ef709e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:47094","PortSpecifier":{"PortValue":47094}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f64c2158-c8e3-442f-a42f-e60497ef709e","method":"POST","path":"/ai-tenant-e2e-ipp-a-74721a/ipp-route-74721a/v1/chat/completions","host":"e2e-ipp-a-74721a.apps.e05eeaa2-7b56-4c28-a8df-162e45941c70.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-28T00:27:42Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f64c2158-c8e3-442f-a42f-e60497ef709e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:47094","PortSpecifier":{"PortValue":47094}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785198462,"nanos":501539509},"http":{"id":"f64c2158-c8e3-442f-a42f-e60497ef709e","method":"POST","headers":{":authority":"e2e-ipp-a-74721a.apps.e05eeaa2-7b56-4c28-a8df-162e45941c70.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-ipp-a-74721a/ipp-route-74721a/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T00:27:42Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f64c2158-c8e3-442f-a42f-e60497ef709e","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-p88HvAIarFxgaLJp_TXmZtdMOnDzSMJbcxrQ7OdrqB0dyDlDPmvm5EK0WMq1"}
{"level":"debug","ts":"2026-07-28T00:27:42Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f64c2158-c8e3-442f-a42f-e60497ef709e","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-ipp-a-74721a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-p88HvAIarFxgaLJp_TXmZtdMOnDzSMJbcxrQ7OdrqB0dyDlDPmvm5EK0WMq1\"}"}
{"level":"debug","ts":"2026-07-28T00:27:42Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f64c2158-c8e3-442f-a42f-e60497ef709e","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-ipp-a-74721a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"594a3e07-bbff-432d-84f9-0b26f04dc2b0","keyName":"e2e-ipp-74721a","subscription":"ipp-route-74721a-sub","tenant":"e2e-ipp-a-74721a","userId":"594a3e07-bbff-432d-84f9-0b26f04dc2b0","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-28T00:27:42Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f64c2158-c8e3-442f-a42f-e60497ef709e","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-ipp-a-74721a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-ipp-a-74721a/ipp-route-74721a\",\"requestedSubscription\":\"ipp-route-74721a-sub\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-28T00:27:42Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f64c2158-c8e3-442f-a42f-e60497ef709e","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-ipp-a-74721a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-ipp-a-74721a/models/facebook/opt-125m","name":"ipp-route-74721a","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"ipp-route-74721a-sub","namespace":"ai-tenant-e2e-ipp-a-74721a","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-ipp-a-74721a/ipp-route-74721a"}}
{"level":"debug","ts":"2026-07-28T00:27:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f64c2158-c8e3-442f-a42f-e60497ef709e","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T00:27:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f64c2158-c8e3-442f-a42f-e60497ef709e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T00:27:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f64c2158-c8e3-442f-a42f-e60497ef709e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T00:27:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f64c2158-c8e3-442f-a42f-e60497ef709e","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T00:27:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f64c2158-c8e3-442f-a42f-e60497ef709e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-ipp-a-74721a/ipp-route-74721a\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-ipp-a-74721a/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T00:27:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f64c2158-c8e3-442f-a42f-e60497ef709e","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-28T00:27:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f64c2158-c8e3-442f-a42f-e60497ef709e","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-28T00:27:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f64c2158-c8e3-442f-a42f-e60497ef709e","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"ipp-route-74721a-sub"}
{"level":"debug","ts":"2026-07-28T00:27:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f64c2158-c8e3-442f-a42f-e60497ef709e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"594a3e07-bbff-432d-84f9-0b26f04dc2b0","keyName":"e2e-ipp-74721a","selected_subscription":"ipp-route-74721a-sub","selected_subscription_key":"ai-tenant-e2e-ipp-a-74721a/ipp-route-74721a-sub@ai-tenant-e2e-ipp-a-74721a/ipp-route-74721a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-ipp-a-74721a/models/facebook/opt-125m","name":"ipp-route-74721a","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"ipp-route-74721a-sub","namespace":"ai-tenant-e2e-ipp-a-74721a","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-ipp-a-74721a/ipp-route-74721a"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-28T00:27:42Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f64c2158-c8e3-442f-a42f-e60497ef709e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-28T00:27:42Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f64c2158-c8e3-442f-a42f-e60497ef709e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-28T00:28:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/509e7f4b38aad5ab58d2c2634e8e6ffe310fdc4f52c8972d5e12429b96801146"}
{"level":"info","ts":"2026-07-28T00:28:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/81cbae7834337c342856e36963aaaf3ffa4bf45951af89db77bc9a4cd8aa4564"}
{"level":"info","ts":"2026-07-28T00:28:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a0f77829d597a550f30847d5ed17baaa0ad0da88d1a11bde7dbd5fcee202a976"}
{"level":"info","ts":"2026-07-28T00:28:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d0b833cf883cdbee378be2dae14a78fbd2eedec48c97666daeaf4fd2ac18add1"}
{"level":"info","ts":"2026-07-28T00:28:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c8964b6b710705dec71229c975d699c0038216416ee8dfd8968d79fd07dd03d2"}
{"level":"info","ts":"2026-07-28T00:28:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7ff94dcb7b8817e99a20069a8faaa53f5aae11d3b1703f3a7f2dee383e00a769"}
{"level":"info","ts":"2026-07-28T00:28:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c000117fe2485bb6d5d659cc919272f5b800abe700a16aa981bf9c5ee0279949"}
{"level":"info","ts":"2026-07-28T00:28:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/053335dad976aa79b23d930e0511a6651a79276e6b2a0a95a92add5a9c14312b"}
{"level":"info","ts":"2026-07-28T00:28:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/761675e7ed81e205f0d2421581524a73ef7685569997f03bae752df609626186"}
{"level":"info","ts":"2026-07-28T00:28:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c0938324fab2d036aba66acd18d51e6297413259bbf3eefc75dc938d1cc426b6"}
{"level":"info","ts":"2026-07-28T00:28:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f3cda189d3e6578dffd705397b8f7436ab983556ff5f1fc24e27e085693593fa"}
{"level":"info","ts":"2026-07-28T00:28:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/49faa9965cbf140b362d681bcbff304a3cb93886fcc784c1394b20365fd37017"}