{"level":"info","ts":"2026-07-29T20:20:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7634c7b6799a347598494197b05972dedf1c19e476946a8e202bdccf919d40db","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T20:20:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"229028f95338caa29a8b1416bb1e8fce36a07ea3a941eecc36e036030bee4040","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T20:20:40Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T20:20:40Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["229028f95338caa29a8b1416bb1e8fce36a07ea3a941eecc36e036030bee4040"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T20:20:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7634c7b6799a347598494197b05972dedf1c19e476946a8e202bdccf919d40db"}
{"level":"info","ts":"2026-07-29T20:20:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"229028f95338caa29a8b1416bb1e8fce36a07ea3a941eecc36e036030bee4040","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T20:20:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"03c1983b72179d113fcf2c17e3965b7ac73e94c901e74876a13f20125aff0349","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T20:20:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f6efb8c1d58204f9b71bb1cef766a2b223ba68936dccee2613a0dc8b98171f95","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T20:20:40Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T20:20:40Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["f6efb8c1d58204f9b71bb1cef766a2b223ba68936dccee2613a0dc8b98171f95"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T20:20:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/229028f95338caa29a8b1416bb1e8fce36a07ea3a941eecc36e036030bee4040"}
{"level":"info","ts":"2026-07-29T20:20:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f6efb8c1d58204f9b71bb1cef766a2b223ba68936dccee2613a0dc8b98171f95","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T20:20:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1b0bef7d4f4a20dae9af7bb5e51fae366d09bcd535ed85c477bfba8f25b18a95","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T20:20:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3e617edc9e6643c7d7c211ab315bbce10e24c646cd50291c925569cb2df976a0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T20:20:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"08219bf7942347fdde67cbf7428f9a5fabb7e907009bf592cc182cd8d08469b0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T20:20:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"27e788a5304381312089b7b8b63d6f2787c9d3f8cf8a96efdf91f099b0e87718","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T20:20:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2a339e743846c8e7814fa9e6397ef9b173c0e62bd8778b1fc2b9da4c4956f84f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T20:20:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e4030fd333572aae8cc24149203db37439ac8f3058ef136636634b9f8d1653e0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T20:20:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7591b01ad2873206d14c4977516a543d010fba69b7834c5dbfb61273e14c0201","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T20:20:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7634c7b6799a347598494197b05972dedf1c19e476946a8e202bdccf919d40db","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T20:20:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"229028f95338caa29a8b1416bb1e8fce36a07ea3a941eecc36e036030bee4040","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T20:20:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f6efb8c1d58204f9b71bb1cef766a2b223ba68936dccee2613a0dc8b98171f95","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T20:20:40Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T20:20:40Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T20:20:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f6efb8c1d58204f9b71bb1cef766a2b223ba68936dccee2613a0dc8b98171f95"}
{"level":"info","ts":"2026-07-29T20:20:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f6efb8c1d58204f9b71bb1cef766a2b223ba68936dccee2613a0dc8b98171f95","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T20:20:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f6efb8c1d58204f9b71bb1cef766a2b223ba68936dccee2613a0dc8b98171f95","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T20:20:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f6efb8c1d58204f9b71bb1cef766a2b223ba68936dccee2613a0dc8b98171f95","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-29T20:20:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f6efb8c1d58204f9b71bb1cef766a2b223ba68936dccee2613a0dc8b98171f95"}
{"level":"debug","ts":"2026-07-29T20:20:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f6efb8c1d58204f9b71bb1cef766a2b223ba68936dccee2613a0dc8b98171f95","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T20:20:40Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T20:20:40Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["f6efb8c1d58204f9b71bb1cef766a2b223ba68936dccee2613a0dc8b98171f95"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T20:20:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f6efb8c1d58204f9b71bb1cef766a2b223ba68936dccee2613a0dc8b98171f95","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T20:20:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f6efb8c1d58204f9b71bb1cef766a2b223ba68936dccee2613a0dc8b98171f95","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T20:20:40Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T20:20:40Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T20:20:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f6efb8c1d58204f9b71bb1cef766a2b223ba68936dccee2613a0dc8b98171f95"}
{"level":"info","ts":"2026-07-29T20:20:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f6efb8c1d58204f9b71bb1cef766a2b223ba68936dccee2613a0dc8b98171f95","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T20:20:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f6efb8c1d58204f9b71bb1cef766a2b223ba68936dccee2613a0dc8b98171f95","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T20:20:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f6efb8c1d58204f9b71bb1cef766a2b223ba68936dccee2613a0dc8b98171f95","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-29T20:20:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f6efb8c1d58204f9b71bb1cef766a2b223ba68936dccee2613a0dc8b98171f95"}
{"level":"debug","ts":"2026-07-29T20:20:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f6efb8c1d58204f9b71bb1cef766a2b223ba68936dccee2613a0dc8b98171f95","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T20:20:40Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T20:20:40Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["f6efb8c1d58204f9b71bb1cef766a2b223ba68936dccee2613a0dc8b98171f95"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T20:20:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f6efb8c1d58204f9b71bb1cef766a2b223ba68936dccee2613a0dc8b98171f95","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T20:20:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f6efb8c1d58204f9b71bb1cef766a2b223ba68936dccee2613a0dc8b98171f95","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-29T20:20:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f6efb8c1d58204f9b71bb1cef766a2b223ba68936dccee2613a0dc8b98171f95"}
{"level":"info","ts":"2026-07-29T20:20:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"572fd48f-5bef-4842-8960-aa5f36c0ca60","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:41774","PortSpecifier":{"PortValue":41774}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"572fd48f-5bef-4842-8960-aa5f36c0ca60","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-7d4a80.apps.e7e0ef25-19c0-4a1e-b260-218071585b15.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-29T20:20:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"572fd48f-5bef-4842-8960-aa5f36c0ca60","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:41774","PortSpecifier":{"PortValue":41774}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785356457,"nanos":47101725},"http":{"id":"572fd48f-5bef-4842-8960-aa5f36c0ca60","method":"POST","headers":{":authority":"e2e-shared-a-7d4a80.apps.e7e0ef25-19c0-4a1e-b260-218071585b15.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T20:20:57Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"572fd48f-5bef-4842-8960-aa5f36c0ca60","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-29T20:20:57Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"572fd48f-5bef-4842-8960-aa5f36c0ca60","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"5a61d67c-746d-4d9a-be81-db484d5ce9f0","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=25be2bf6-b8ab-4b2e-8cad-1eabd3151489"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/218071585b15"]}}
{"level":"debug","ts":"2026-07-29T20:20:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"572fd48f-5bef-4842-8960-aa5f36c0ca60","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/218071585b15"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=25be2bf6-b8ab-4b2e-8cad-1eabd3151489"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"5a61d67c-746d-4d9a-be81-db484d5ce9f0","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"3e617edc9e6643c7d7c211ab315bbce10e24c646cd50291c925569cb2df976a0"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.54:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-7d4a80.apps.e7e0ef25-19c0-4a1e-b260-218071585b15.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T20:20:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"572fd48f-5bef-4842-8960-aa5f36c0ca60","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T20:20:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"572fd48f-5bef-4842-8960-aa5f36c0ca60","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T20:20:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"572fd48f-5bef-4842-8960-aa5f36c0ca60","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7d4a80/rate-test-model-7d4a80\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-7d4a80/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T20:20:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"572fd48f-5bef-4842-8960-aa5f36c0ca60","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-29T20:20:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"572fd48f-5bef-4842-8960-aa5f36c0ca60","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-29T20:20:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"572fd48f-5bef-4842-8960-aa5f36c0ca60","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-29T20:20:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"572fd48f-5bef-4842-8960-aa5f36c0ca60","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-29T20:20:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"572fd48f-5bef-4842-8960-aa5f36c0ca60","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-29T20:20:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"64359b58-5570-4c8d-a591-79e1606be2d0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:36202","PortSpecifier":{"PortValue":36202}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"64359b58-5570-4c8d-a591-79e1606be2d0","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-1a1eaa.apps.e7e0ef25-19c0-4a1e-b260-218071585b15.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-29T20:20:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"64359b58-5570-4c8d-a591-79e1606be2d0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:36202","PortSpecifier":{"PortValue":36202}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785356457,"nanos":87361466},"http":{"id":"64359b58-5570-4c8d-a591-79e1606be2d0","method":"POST","headers":{":authority":"e2e-shared-b-1a1eaa.apps.e7e0ef25-19c0-4a1e-b260-218071585b15.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T20:20:57Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"64359b58-5570-4c8d-a591-79e1606be2d0","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-29T20:20:57Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"64359b58-5570-4c8d-a591-79e1606be2d0","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"5a61d67c-746d-4d9a-be81-db484d5ce9f0","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=25be2bf6-b8ab-4b2e-8cad-1eabd3151489"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/218071585b15"]}}
{"level":"debug","ts":"2026-07-29T20:20:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"64359b58-5570-4c8d-a591-79e1606be2d0","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/218071585b15"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=25be2bf6-b8ab-4b2e-8cad-1eabd3151489"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"5a61d67c-746d-4d9a-be81-db484d5ce9f0","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"229028f95338caa29a8b1416bb1e8fce36a07ea3a941eecc36e036030bee4040"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.55:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-1a1eaa.apps.e7e0ef25-19c0-4a1e-b260-218071585b15.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T20:20:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"64359b58-5570-4c8d-a591-79e1606be2d0","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T20:20:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"64359b58-5570-4c8d-a591-79e1606be2d0","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T20:20:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"64359b58-5570-4c8d-a591-79e1606be2d0","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-1a1eaa/rate-test-model-1a1eaa\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-1a1eaa/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T20:20:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"64359b58-5570-4c8d-a591-79e1606be2d0","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-29T20:20:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"64359b58-5570-4c8d-a591-79e1606be2d0","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-29T20:20:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"64359b58-5570-4c8d-a591-79e1606be2d0","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-29T20:20:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"64359b58-5570-4c8d-a591-79e1606be2d0","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-29T20:20:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"64359b58-5570-4c8d-a591-79e1606be2d0","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-29T20:20:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"dc85f3af-5575-4cae-bcf9-2f5c70cb4596","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:41778","PortSpecifier":{"PortValue":41778}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"dc85f3af-5575-4cae-bcf9-2f5c70cb4596","method":"POST","path":"/ai-tenant-e2e-shared-a-7d4a80/rate-test-model-7d4a80/v1/completions","host":"e2e-shared-a-7d4a80.apps.e7e0ef25-19c0-4a1e-b260-218071585b15.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-29T20:20:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"dc85f3af-5575-4cae-bcf9-2f5c70cb4596","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:41778","PortSpecifier":{"PortValue":41778}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785356457,"nanos":127552501},"http":{"id":"dc85f3af-5575-4cae-bcf9-2f5c70cb4596","method":"POST","headers":{":authority":"e2e-shared-a-7d4a80.apps.e7e0ef25-19c0-4a1e-b260-218071585b15.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-7d4a80/rate-test-model-7d4a80/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T20:20:57Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"dc85f3af-5575-4cae-bcf9-2f5c70cb4596","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-17nlvTHEIQFFwNYAv_8YyLbH6ZZ96D2Hr9MSgsyVXjWiSGMOfaZ3AzockmV6Y"}
{"level":"debug","ts":"2026-07-29T20:20:57Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"dc85f3af-5575-4cae-bcf9-2f5c70cb4596","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-7d4a80.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-17nlvTHEIQFFwNYAv_8YyLbH6ZZ96D2Hr9MSgsyVXjWiSGMOfaZ3AzockmV6Y\"}"}
{"level":"debug","ts":"2026-07-29T20:20:57Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"dc85f3af-5575-4cae-bcf9-2f5c70cb4596","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d4a80.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"c261f99d-4435-4172-8c49-0f3f956f9071","keyName":"e2e-rate-a-1aa656","subscription":"e2e-rate-iso-a-1aa656","tenant":"e2e-shared-a-7d4a80","userId":"c261f99d-4435-4172-8c49-0f3f956f9071","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-29T20:20:57Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"dc85f3af-5575-4cae-bcf9-2f5c70cb4596","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-7d4a80.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-7d4a80/rate-test-model-7d4a80\",\"requestedSubscription\":\"e2e-rate-iso-a-1aa656\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-29T20:20:57Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"dc85f3af-5575-4cae-bcf9-2f5c70cb4596","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d4a80.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-7d4a80/models/facebook/opt-125m","name":"rate-test-model-7d4a80","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-1aa656","namespace":"ai-tenant-e2e-shared-a-7d4a80","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-7d4a80/rate-test-model-7d4a80"}}
{"level":"debug","ts":"2026-07-29T20:20:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"dc85f3af-5575-4cae-bcf9-2f5c70cb4596","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T20:20:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dc85f3af-5575-4cae-bcf9-2f5c70cb4596","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T20:20:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dc85f3af-5575-4cae-bcf9-2f5c70cb4596","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T20:20:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dc85f3af-5575-4cae-bcf9-2f5c70cb4596","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7d4a80/rate-test-model-7d4a80\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-7d4a80/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T20:20:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dc85f3af-5575-4cae-bcf9-2f5c70cb4596","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T20:20:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dc85f3af-5575-4cae-bcf9-2f5c70cb4596","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-1aa656"}
{"level":"debug","ts":"2026-07-29T20:20:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dc85f3af-5575-4cae-bcf9-2f5c70cb4596","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-29T20:20:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dc85f3af-5575-4cae-bcf9-2f5c70cb4596","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-29T20:20:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dc85f3af-5575-4cae-bcf9-2f5c70cb4596","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"c261f99d-4435-4172-8c49-0f3f956f9071","keyName":"e2e-rate-a-1aa656","selected_subscription":"e2e-rate-iso-a-1aa656","selected_subscription_key":"ai-tenant-e2e-shared-a-7d4a80/e2e-rate-iso-a-1aa656@ai-tenant-e2e-shared-a-7d4a80/rate-test-model-7d4a80","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-7d4a80/models/facebook/opt-125m","name":"rate-test-model-7d4a80","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-1aa656","namespace":"ai-tenant-e2e-shared-a-7d4a80","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-7d4a80/rate-test-model-7d4a80"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-29T20:20:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"dc85f3af-5575-4cae-bcf9-2f5c70cb4596","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-29T20:20:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"dc85f3af-5575-4cae-bcf9-2f5c70cb4596","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-29T20:20:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"eba66e1b-7e32-48e4-92d6-0aafec9da38f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:41782","PortSpecifier":{"PortValue":41782}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"eba66e1b-7e32-48e4-92d6-0aafec9da38f","method":"POST","path":"/ai-tenant-e2e-shared-a-7d4a80/rate-test-model-7d4a80/v1/completions","host":"e2e-shared-a-7d4a80.apps.e7e0ef25-19c0-4a1e-b260-218071585b15.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-29T20:20:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"eba66e1b-7e32-48e4-92d6-0aafec9da38f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:41782","PortSpecifier":{"PortValue":41782}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785356458,"nanos":217804321},"http":{"id":"eba66e1b-7e32-48e4-92d6-0aafec9da38f","method":"POST","headers":{":authority":"e2e-shared-a-7d4a80.apps.e7e0ef25-19c0-4a1e-b260-218071585b15.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-7d4a80/rate-test-model-7d4a80/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T20:20:58Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"eba66e1b-7e32-48e4-92d6-0aafec9da38f","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-17nlvTHEIQFFwNYAv_8YyLbH6ZZ96D2Hr9MSgsyVXjWiSGMOfaZ3AzockmV6Y"}
{"level":"debug","ts":"2026-07-29T20:20:58Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"eba66e1b-7e32-48e4-92d6-0aafec9da38f","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-7d4a80.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-17nlvTHEIQFFwNYAv_8YyLbH6ZZ96D2Hr9MSgsyVXjWiSGMOfaZ3AzockmV6Y\"}"}
{"level":"debug","ts":"2026-07-29T20:20:58Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"eba66e1b-7e32-48e4-92d6-0aafec9da38f","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d4a80.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"c261f99d-4435-4172-8c49-0f3f956f9071","keyName":"e2e-rate-a-1aa656","subscription":"e2e-rate-iso-a-1aa656","tenant":"e2e-shared-a-7d4a80","userId":"c261f99d-4435-4172-8c49-0f3f956f9071","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-29T20:20:58Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"eba66e1b-7e32-48e4-92d6-0aafec9da38f","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-7d4a80.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-7d4a80/rate-test-model-7d4a80\",\"requestedSubscription\":\"e2e-rate-iso-a-1aa656\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-29T20:20:58Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"eba66e1b-7e32-48e4-92d6-0aafec9da38f","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d4a80.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-7d4a80/models/facebook/opt-125m","name":"rate-test-model-7d4a80","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-1aa656","namespace":"ai-tenant-e2e-shared-a-7d4a80","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-7d4a80/rate-test-model-7d4a80"}}
{"level":"debug","ts":"2026-07-29T20:20:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"eba66e1b-7e32-48e4-92d6-0aafec9da38f","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T20:20:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"eba66e1b-7e32-48e4-92d6-0aafec9da38f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T20:20:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"eba66e1b-7e32-48e4-92d6-0aafec9da38f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T20:20:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"eba66e1b-7e32-48e4-92d6-0aafec9da38f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7d4a80/rate-test-model-7d4a80\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-7d4a80/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T20:20:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"eba66e1b-7e32-48e4-92d6-0aafec9da38f","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T20:20:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"eba66e1b-7e32-48e4-92d6-0aafec9da38f","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-29T20:20:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"eba66e1b-7e32-48e4-92d6-0aafec9da38f","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-1aa656"}
{"level":"debug","ts":"2026-07-29T20:20:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"eba66e1b-7e32-48e4-92d6-0aafec9da38f","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-29T20:20:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"eba66e1b-7e32-48e4-92d6-0aafec9da38f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"c261f99d-4435-4172-8c49-0f3f956f9071","keyName":"e2e-rate-a-1aa656","selected_subscription":"e2e-rate-iso-a-1aa656","selected_subscription_key":"ai-tenant-e2e-shared-a-7d4a80/e2e-rate-iso-a-1aa656@ai-tenant-e2e-shared-a-7d4a80/rate-test-model-7d4a80","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-7d4a80/models/facebook/opt-125m","name":"rate-test-model-7d4a80","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-1aa656","namespace":"ai-tenant-e2e-shared-a-7d4a80","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-7d4a80/rate-test-model-7d4a80"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-29T20:20:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"eba66e1b-7e32-48e4-92d6-0aafec9da38f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-29T20:20:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"eba66e1b-7e32-48e4-92d6-0aafec9da38f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-29T20:20:59Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0541e80b-f6b0-460c-bc15-32cfb784d888","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:41790","PortSpecifier":{"PortValue":41790}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0541e80b-f6b0-460c-bc15-32cfb784d888","method":"POST","path":"/ai-tenant-e2e-shared-a-7d4a80/rate-test-model-7d4a80/v1/completions","host":"e2e-shared-a-7d4a80.apps.e7e0ef25-19c0-4a1e-b260-218071585b15.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-29T20:20:59Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0541e80b-f6b0-460c-bc15-32cfb784d888","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:41790","PortSpecifier":{"PortValue":41790}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785356459,"nanos":258152561},"http":{"id":"0541e80b-f6b0-460c-bc15-32cfb784d888","method":"POST","headers":{":authority":"e2e-shared-a-7d4a80.apps.e7e0ef25-19c0-4a1e-b260-218071585b15.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-7d4a80/rate-test-model-7d4a80/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T20:20:59Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0541e80b-f6b0-460c-bc15-32cfb784d888","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-17nlvTHEIQFFwNYAv_8YyLbH6ZZ96D2Hr9MSgsyVXjWiSGMOfaZ3AzockmV6Y"}
{"level":"debug","ts":"2026-07-29T20:20:59Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0541e80b-f6b0-460c-bc15-32cfb784d888","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-7d4a80.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-17nlvTHEIQFFwNYAv_8YyLbH6ZZ96D2Hr9MSgsyVXjWiSGMOfaZ3AzockmV6Y\"}"}
{"level":"debug","ts":"2026-07-29T20:20:59Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0541e80b-f6b0-460c-bc15-32cfb784d888","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d4a80.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"c261f99d-4435-4172-8c49-0f3f956f9071","keyName":"e2e-rate-a-1aa656","subscription":"e2e-rate-iso-a-1aa656","tenant":"e2e-shared-a-7d4a80","userId":"c261f99d-4435-4172-8c49-0f3f956f9071","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-29T20:20:59Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0541e80b-f6b0-460c-bc15-32cfb784d888","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-7d4a80.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-7d4a80/rate-test-model-7d4a80\",\"requestedSubscription\":\"e2e-rate-iso-a-1aa656\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-29T20:20:59Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0541e80b-f6b0-460c-bc15-32cfb784d888","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d4a80.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-7d4a80/models/facebook/opt-125m","name":"rate-test-model-7d4a80","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-1aa656","namespace":"ai-tenant-e2e-shared-a-7d4a80","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-7d4a80/rate-test-model-7d4a80"}}
{"level":"debug","ts":"2026-07-29T20:20:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0541e80b-f6b0-460c-bc15-32cfb784d888","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T20:20:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0541e80b-f6b0-460c-bc15-32cfb784d888","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T20:20:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0541e80b-f6b0-460c-bc15-32cfb784d888","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T20:20:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0541e80b-f6b0-460c-bc15-32cfb784d888","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T20:20:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0541e80b-f6b0-460c-bc15-32cfb784d888","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7d4a80/rate-test-model-7d4a80\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-7d4a80/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T20:20:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0541e80b-f6b0-460c-bc15-32cfb784d888","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-29T20:20:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0541e80b-f6b0-460c-bc15-32cfb784d888","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-29T20:20:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0541e80b-f6b0-460c-bc15-32cfb784d888","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-1aa656"}
{"level":"debug","ts":"2026-07-29T20:20:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0541e80b-f6b0-460c-bc15-32cfb784d888","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"c261f99d-4435-4172-8c49-0f3f956f9071","keyName":"e2e-rate-a-1aa656","selected_subscription":"e2e-rate-iso-a-1aa656","selected_subscription_key":"ai-tenant-e2e-shared-a-7d4a80/e2e-rate-iso-a-1aa656@ai-tenant-e2e-shared-a-7d4a80/rate-test-model-7d4a80","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-7d4a80/models/facebook/opt-125m","name":"rate-test-model-7d4a80","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-1aa656","namespace":"ai-tenant-e2e-shared-a-7d4a80","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-7d4a80/rate-test-model-7d4a80"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-29T20:20:59Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0541e80b-f6b0-460c-bc15-32cfb784d888","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-29T20:20:59Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0541e80b-f6b0-460c-bc15-32cfb784d888","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-29T20:21:15Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7cb5a42b-6d84-4914-b8ea-ecc195a163ce","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:41736","PortSpecifier":{"PortValue":41736}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"7cb5a42b-6d84-4914-b8ea-ecc195a163ce","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-7d4a80.apps.e7e0ef25-19c0-4a1e-b260-218071585b15.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-29T20:21:15Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7cb5a42b-6d84-4914-b8ea-ecc195a163ce","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:41736","PortSpecifier":{"PortValue":41736}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785356475,"nanos":392377736},"http":{"id":"7cb5a42b-6d84-4914-b8ea-ecc195a163ce","method":"POST","headers":{":authority":"e2e-shared-a-7d4a80.apps.e7e0ef25-19c0-4a1e-b260-218071585b15.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T20:21:15Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"7cb5a42b-6d84-4914-b8ea-ecc195a163ce","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-29T20:21:15Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"7cb5a42b-6d84-4914-b8ea-ecc195a163ce","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"5a61d67c-746d-4d9a-be81-db484d5ce9f0","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=25be2bf6-b8ab-4b2e-8cad-1eabd3151489"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/218071585b15"]}}
{"level":"debug","ts":"2026-07-29T20:21:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"7cb5a42b-6d84-4914-b8ea-ecc195a163ce","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/218071585b15"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=25be2bf6-b8ab-4b2e-8cad-1eabd3151489"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"5a61d67c-746d-4d9a-be81-db484d5ce9f0","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"3e617edc9e6643c7d7c211ab315bbce10e24c646cd50291c925569cb2df976a0"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.54:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-7d4a80.apps.e7e0ef25-19c0-4a1e-b260-218071585b15.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T20:21:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7cb5a42b-6d84-4914-b8ea-ecc195a163ce","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T20:21:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7cb5a42b-6d84-4914-b8ea-ecc195a163ce","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T20:21:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7cb5a42b-6d84-4914-b8ea-ecc195a163ce","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7d4a80/rate-test-model-7d4a80\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-7d4a80/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T20:21:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"7cb5a42b-6d84-4914-b8ea-ecc195a163ce","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-29T20:21:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7cb5a42b-6d84-4914-b8ea-ecc195a163ce","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-29T20:21:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7cb5a42b-6d84-4914-b8ea-ecc195a163ce","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-29T20:21:15Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7cb5a42b-6d84-4914-b8ea-ecc195a163ce","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-29T20:21:15Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7cb5a42b-6d84-4914-b8ea-ecc195a163ce","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-29T20:21:15Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"39a2d371-4546-45d6-b7ce-e07d0387a574","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:44412","PortSpecifier":{"PortValue":44412}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"39a2d371-4546-45d6-b7ce-e07d0387a574","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-1a1eaa.apps.e7e0ef25-19c0-4a1e-b260-218071585b15.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-29T20:21:15Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"39a2d371-4546-45d6-b7ce-e07d0387a574","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:44412","PortSpecifier":{"PortValue":44412}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785356475,"nanos":425410231},"http":{"id":"39a2d371-4546-45d6-b7ce-e07d0387a574","method":"POST","headers":{":authority":"e2e-shared-b-1a1eaa.apps.e7e0ef25-19c0-4a1e-b260-218071585b15.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T20:21:15Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"39a2d371-4546-45d6-b7ce-e07d0387a574","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-29T20:21:15Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"39a2d371-4546-45d6-b7ce-e07d0387a574","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"5a61d67c-746d-4d9a-be81-db484d5ce9f0","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=25be2bf6-b8ab-4b2e-8cad-1eabd3151489"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/218071585b15"]}}
{"level":"debug","ts":"2026-07-29T20:21:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"39a2d371-4546-45d6-b7ce-e07d0387a574","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/218071585b15"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=25be2bf6-b8ab-4b2e-8cad-1eabd3151489"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"5a61d67c-746d-4d9a-be81-db484d5ce9f0","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"229028f95338caa29a8b1416bb1e8fce36a07ea3a941eecc36e036030bee4040"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.55:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-1a1eaa.apps.e7e0ef25-19c0-4a1e-b260-218071585b15.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T20:21:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"39a2d371-4546-45d6-b7ce-e07d0387a574","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T20:21:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"39a2d371-4546-45d6-b7ce-e07d0387a574","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T20:21:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"39a2d371-4546-45d6-b7ce-e07d0387a574","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-1a1eaa/rate-test-model-1a1eaa\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-1a1eaa/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T20:21:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"39a2d371-4546-45d6-b7ce-e07d0387a574","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-29T20:21:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"39a2d371-4546-45d6-b7ce-e07d0387a574","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-29T20:21:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"39a2d371-4546-45d6-b7ce-e07d0387a574","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-29T20:21:15Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"39a2d371-4546-45d6-b7ce-e07d0387a574","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-29T20:21:15Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"39a2d371-4546-45d6-b7ce-e07d0387a574","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-29T20:21:15Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d29cc5a1-7d8f-4d78-82ad-2b5eb6c23ff1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:41740","PortSpecifier":{"PortValue":41740}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d29cc5a1-7d8f-4d78-82ad-2b5eb6c23ff1","method":"POST","path":"/ai-tenant-e2e-shared-a-7d4a80/rate-test-model-7d4a80/v1/completions","host":"e2e-shared-a-7d4a80.apps.e7e0ef25-19c0-4a1e-b260-218071585b15.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-29T20:21:15Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d29cc5a1-7d8f-4d78-82ad-2b5eb6c23ff1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:41740","PortSpecifier":{"PortValue":41740}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785356475,"nanos":460481112},"http":{"id":"d29cc5a1-7d8f-4d78-82ad-2b5eb6c23ff1","method":"POST","headers":{":authority":"e2e-shared-a-7d4a80.apps.e7e0ef25-19c0-4a1e-b260-218071585b15.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-7d4a80/rate-test-model-7d4a80/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T20:21:15Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d29cc5a1-7d8f-4d78-82ad-2b5eb6c23ff1","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-VZ2y8B2x2pGPd5Ik_a5jeJXYISSdYAKFINqH3a7k8PejP6fQGL93ERJ5dAko"}
{"level":"debug","ts":"2026-07-29T20:21:15Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d29cc5a1-7d8f-4d78-82ad-2b5eb6c23ff1","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-7d4a80.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-VZ2y8B2x2pGPd5Ik_a5jeJXYISSdYAKFINqH3a7k8PejP6fQGL93ERJ5dAko\"}"}
{"level":"debug","ts":"2026-07-29T20:21:15Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d29cc5a1-7d8f-4d78-82ad-2b5eb6c23ff1","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d4a80.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"b3eb56bf-b0e3-4b2e-bef0-ca9080e1021f","keyName":"e2e-rate-a-c781c2","subscription":"e2e-rate-iso-a-c781c2","tenant":"e2e-shared-a-7d4a80","userId":"b3eb56bf-b0e3-4b2e-bef0-ca9080e1021f","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-29T20:21:15Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d29cc5a1-7d8f-4d78-82ad-2b5eb6c23ff1","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-7d4a80.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-7d4a80/rate-test-model-7d4a80\",\"requestedSubscription\":\"e2e-rate-iso-a-c781c2\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-29T20:21:15Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d29cc5a1-7d8f-4d78-82ad-2b5eb6c23ff1","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d4a80.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-7d4a80/models/facebook/opt-125m","name":"rate-test-model-7d4a80","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-c781c2","namespace":"ai-tenant-e2e-shared-a-7d4a80","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-7d4a80/rate-test-model-7d4a80"}}
{"level":"debug","ts":"2026-07-29T20:21:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d29cc5a1-7d8f-4d78-82ad-2b5eb6c23ff1","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T20:21:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d29cc5a1-7d8f-4d78-82ad-2b5eb6c23ff1","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T20:21:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d29cc5a1-7d8f-4d78-82ad-2b5eb6c23ff1","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7d4a80/rate-test-model-7d4a80\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-7d4a80/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T20:21:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d29cc5a1-7d8f-4d78-82ad-2b5eb6c23ff1","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T20:21:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d29cc5a1-7d8f-4d78-82ad-2b5eb6c23ff1","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T20:21:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d29cc5a1-7d8f-4d78-82ad-2b5eb6c23ff1","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-29T20:21:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d29cc5a1-7d8f-4d78-82ad-2b5eb6c23ff1","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-29T20:21:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d29cc5a1-7d8f-4d78-82ad-2b5eb6c23ff1","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-c781c2"}
{"level":"debug","ts":"2026-07-29T20:21:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d29cc5a1-7d8f-4d78-82ad-2b5eb6c23ff1","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"b3eb56bf-b0e3-4b2e-bef0-ca9080e1021f","keyName":"e2e-rate-a-c781c2","selected_subscription":"e2e-rate-iso-a-c781c2","selected_subscription_key":"ai-tenant-e2e-shared-a-7d4a80/e2e-rate-iso-a-c781c2@ai-tenant-e2e-shared-a-7d4a80/rate-test-model-7d4a80","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-7d4a80/models/facebook/opt-125m","name":"rate-test-model-7d4a80","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-c781c2","namespace":"ai-tenant-e2e-shared-a-7d4a80","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-7d4a80/rate-test-model-7d4a80"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-29T20:21:15Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d29cc5a1-7d8f-4d78-82ad-2b5eb6c23ff1","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-29T20:21:15Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d29cc5a1-7d8f-4d78-82ad-2b5eb6c23ff1","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-29T20:21:16Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b67895e0-7cdf-410d-ae22-d0cd71cc0b9f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:41756","PortSpecifier":{"PortValue":41756}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b67895e0-7cdf-410d-ae22-d0cd71cc0b9f","method":"POST","path":"/ai-tenant-e2e-shared-a-7d4a80/rate-test-model-7d4a80/v1/completions","host":"e2e-shared-a-7d4a80.apps.e7e0ef25-19c0-4a1e-b260-218071585b15.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-29T20:21:16Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b67895e0-7cdf-410d-ae22-d0cd71cc0b9f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:41756","PortSpecifier":{"PortValue":41756}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785356476,"nanos":500834305},"http":{"id":"b67895e0-7cdf-410d-ae22-d0cd71cc0b9f","method":"POST","headers":{":authority":"e2e-shared-a-7d4a80.apps.e7e0ef25-19c0-4a1e-b260-218071585b15.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-7d4a80/rate-test-model-7d4a80/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T20:21:16Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b67895e0-7cdf-410d-ae22-d0cd71cc0b9f","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-VZ2y8B2x2pGPd5Ik_a5jeJXYISSdYAKFINqH3a7k8PejP6fQGL93ERJ5dAko"}
{"level":"debug","ts":"2026-07-29T20:21:16Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b67895e0-7cdf-410d-ae22-d0cd71cc0b9f","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-7d4a80.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-VZ2y8B2x2pGPd5Ik_a5jeJXYISSdYAKFINqH3a7k8PejP6fQGL93ERJ5dAko\"}"}
{"level":"debug","ts":"2026-07-29T20:21:16Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b67895e0-7cdf-410d-ae22-d0cd71cc0b9f","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d4a80.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"b3eb56bf-b0e3-4b2e-bef0-ca9080e1021f","keyName":"e2e-rate-a-c781c2","subscription":"e2e-rate-iso-a-c781c2","tenant":"e2e-shared-a-7d4a80","userId":"b3eb56bf-b0e3-4b2e-bef0-ca9080e1021f","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-29T20:21:16Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b67895e0-7cdf-410d-ae22-d0cd71cc0b9f","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-7d4a80.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-7d4a80/rate-test-model-7d4a80\",\"requestedSubscription\":\"e2e-rate-iso-a-c781c2\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-29T20:21:16Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b67895e0-7cdf-410d-ae22-d0cd71cc0b9f","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d4a80.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-7d4a80/models/facebook/opt-125m","name":"rate-test-model-7d4a80","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-c781c2","namespace":"ai-tenant-e2e-shared-a-7d4a80","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-7d4a80/rate-test-model-7d4a80"}}
{"level":"debug","ts":"2026-07-29T20:21:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b67895e0-7cdf-410d-ae22-d0cd71cc0b9f","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T20:21:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b67895e0-7cdf-410d-ae22-d0cd71cc0b9f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T20:21:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b67895e0-7cdf-410d-ae22-d0cd71cc0b9f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T20:21:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b67895e0-7cdf-410d-ae22-d0cd71cc0b9f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7d4a80/rate-test-model-7d4a80\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-7d4a80/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T20:21:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b67895e0-7cdf-410d-ae22-d0cd71cc0b9f","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T20:21:16Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b67895e0-7cdf-410d-ae22-d0cd71cc0b9f","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-29T20:21:16Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b67895e0-7cdf-410d-ae22-d0cd71cc0b9f","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-29T20:21:16Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b67895e0-7cdf-410d-ae22-d0cd71cc0b9f","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-c781c2"}
{"level":"debug","ts":"2026-07-29T20:21:16Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b67895e0-7cdf-410d-ae22-d0cd71cc0b9f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"b3eb56bf-b0e3-4b2e-bef0-ca9080e1021f","keyName":"e2e-rate-a-c781c2","selected_subscription":"e2e-rate-iso-a-c781c2","selected_subscription_key":"ai-tenant-e2e-shared-a-7d4a80/e2e-rate-iso-a-c781c2@ai-tenant-e2e-shared-a-7d4a80/rate-test-model-7d4a80","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-7d4a80/models/facebook/opt-125m","name":"rate-test-model-7d4a80","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-c781c2","namespace":"ai-tenant-e2e-shared-a-7d4a80","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-7d4a80/rate-test-model-7d4a80"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-29T20:21:16Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b67895e0-7cdf-410d-ae22-d0cd71cc0b9f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-29T20:21:16Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b67895e0-7cdf-410d-ae22-d0cd71cc0b9f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-29T20:21:17Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"90a207c0-8c3d-4bd6-98dc-b7fe9fbc0e6d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:41764","PortSpecifier":{"PortValue":41764}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"90a207c0-8c3d-4bd6-98dc-b7fe9fbc0e6d","method":"POST","path":"/ai-tenant-e2e-shared-a-7d4a80/rate-test-model-7d4a80/v1/completions","host":"e2e-shared-a-7d4a80.apps.e7e0ef25-19c0-4a1e-b260-218071585b15.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-29T20:21:17Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"90a207c0-8c3d-4bd6-98dc-b7fe9fbc0e6d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:41764","PortSpecifier":{"PortValue":41764}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785356477,"nanos":548141487},"http":{"id":"90a207c0-8c3d-4bd6-98dc-b7fe9fbc0e6d","method":"POST","headers":{":authority":"e2e-shared-a-7d4a80.apps.e7e0ef25-19c0-4a1e-b260-218071585b15.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-7d4a80/rate-test-model-7d4a80/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T20:21:17Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"90a207c0-8c3d-4bd6-98dc-b7fe9fbc0e6d","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-VZ2y8B2x2pGPd5Ik_a5jeJXYISSdYAKFINqH3a7k8PejP6fQGL93ERJ5dAko"}
{"level":"debug","ts":"2026-07-29T20:21:17Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"90a207c0-8c3d-4bd6-98dc-b7fe9fbc0e6d","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-7d4a80.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-VZ2y8B2x2pGPd5Ik_a5jeJXYISSdYAKFINqH3a7k8PejP6fQGL93ERJ5dAko\"}"}
{"level":"debug","ts":"2026-07-29T20:21:17Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"90a207c0-8c3d-4bd6-98dc-b7fe9fbc0e6d","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d4a80.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"b3eb56bf-b0e3-4b2e-bef0-ca9080e1021f","keyName":"e2e-rate-a-c781c2","subscription":"e2e-rate-iso-a-c781c2","tenant":"e2e-shared-a-7d4a80","userId":"b3eb56bf-b0e3-4b2e-bef0-ca9080e1021f","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-29T20:21:17Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"90a207c0-8c3d-4bd6-98dc-b7fe9fbc0e6d","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-7d4a80.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-7d4a80/rate-test-model-7d4a80\",\"requestedSubscription\":\"e2e-rate-iso-a-c781c2\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-29T20:21:17Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"90a207c0-8c3d-4bd6-98dc-b7fe9fbc0e6d","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d4a80.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-7d4a80/models/facebook/opt-125m","name":"rate-test-model-7d4a80","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-c781c2","namespace":"ai-tenant-e2e-shared-a-7d4a80","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-7d4a80/rate-test-model-7d4a80"}}
{"level":"debug","ts":"2026-07-29T20:21:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"90a207c0-8c3d-4bd6-98dc-b7fe9fbc0e6d","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T20:21:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"90a207c0-8c3d-4bd6-98dc-b7fe9fbc0e6d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T20:21:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"90a207c0-8c3d-4bd6-98dc-b7fe9fbc0e6d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T20:21:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"90a207c0-8c3d-4bd6-98dc-b7fe9fbc0e6d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7d4a80/rate-test-model-7d4a80\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-7d4a80/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T20:21:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"90a207c0-8c3d-4bd6-98dc-b7fe9fbc0e6d","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T20:21:17Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"90a207c0-8c3d-4bd6-98dc-b7fe9fbc0e6d","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-c781c2"}
{"level":"debug","ts":"2026-07-29T20:21:17Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"90a207c0-8c3d-4bd6-98dc-b7fe9fbc0e6d","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-29T20:21:17Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"90a207c0-8c3d-4bd6-98dc-b7fe9fbc0e6d","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-29T20:21:17Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"90a207c0-8c3d-4bd6-98dc-b7fe9fbc0e6d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"b3eb56bf-b0e3-4b2e-bef0-ca9080e1021f","keyName":"e2e-rate-a-c781c2","selected_subscription":"e2e-rate-iso-a-c781c2","selected_subscription_key":"ai-tenant-e2e-shared-a-7d4a80/e2e-rate-iso-a-c781c2@ai-tenant-e2e-shared-a-7d4a80/rate-test-model-7d4a80","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-7d4a80/models/facebook/opt-125m","name":"rate-test-model-7d4a80","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-c781c2","namespace":"ai-tenant-e2e-shared-a-7d4a80","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-7d4a80/rate-test-model-7d4a80"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-29T20:21:17Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"90a207c0-8c3d-4bd6-98dc-b7fe9fbc0e6d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-29T20:21:17Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"90a207c0-8c3d-4bd6-98dc-b7fe9fbc0e6d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-29T20:21:17Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"73212dc9-be51-404b-aa49-82313e2fab06","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:44422","PortSpecifier":{"PortValue":44422}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"73212dc9-be51-404b-aa49-82313e2fab06","method":"POST","path":"/ai-tenant-e2e-shared-b-1a1eaa/rate-test-model-1a1eaa/v1/completions","host":"e2e-shared-b-1a1eaa.apps.e7e0ef25-19c0-4a1e-b260-218071585b15.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-29T20:21:17Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"73212dc9-be51-404b-aa49-82313e2fab06","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:44422","PortSpecifier":{"PortValue":44422}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785356477,"nanos":582896183},"http":{"id":"73212dc9-be51-404b-aa49-82313e2fab06","method":"POST","headers":{":authority":"e2e-shared-b-1a1eaa.apps.e7e0ef25-19c0-4a1e-b260-218071585b15.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-1a1eaa/rate-test-model-1a1eaa/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T20:21:17Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"73212dc9-be51-404b-aa49-82313e2fab06","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-EDDnp7xVu4x9yvKB_2C8zvwyQwyyDNlMiQzFS8cRKPzPm5H5x2BqUAsWw4Zn"}
{"level":"debug","ts":"2026-07-29T20:21:17Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"73212dc9-be51-404b-aa49-82313e2fab06","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-1a1eaa.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-EDDnp7xVu4x9yvKB_2C8zvwyQwyyDNlMiQzFS8cRKPzPm5H5x2BqUAsWw4Zn\"}"}
{"level":"debug","ts":"2026-07-29T20:21:17Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"73212dc9-be51-404b-aa49-82313e2fab06","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-1a1eaa.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"54586a1f-dba1-4d97-9a45-0d94daeef113","keyName":"e2e-rate-b-c781c2","subscription":"e2e-rate-iso-b-c781c2","tenant":"e2e-shared-b-1a1eaa","userId":"54586a1f-dba1-4d97-9a45-0d94daeef113","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-29T20:21:17Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"73212dc9-be51-404b-aa49-82313e2fab06","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-1a1eaa.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-1a1eaa/rate-test-model-1a1eaa\",\"requestedSubscription\":\"e2e-rate-iso-b-c781c2\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-29T20:21:17Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"73212dc9-be51-404b-aa49-82313e2fab06","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-1a1eaa.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-b-1a1eaa/models/facebook/opt-125m","name":"rate-test-model-1a1eaa","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-c781c2","namespace":"ai-tenant-e2e-shared-b-1a1eaa","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-b-1a1eaa/rate-test-model-1a1eaa"}}
{"level":"debug","ts":"2026-07-29T20:21:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"73212dc9-be51-404b-aa49-82313e2fab06","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T20:21:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"73212dc9-be51-404b-aa49-82313e2fab06","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T20:21:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"73212dc9-be51-404b-aa49-82313e2fab06","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T20:21:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"73212dc9-be51-404b-aa49-82313e2fab06","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-1a1eaa/rate-test-model-1a1eaa\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-1a1eaa/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T20:21:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"73212dc9-be51-404b-aa49-82313e2fab06","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T20:21:17Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"73212dc9-be51-404b-aa49-82313e2fab06","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-29T20:21:17Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"73212dc9-be51-404b-aa49-82313e2fab06","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-c781c2"}
{"level":"debug","ts":"2026-07-29T20:21:17Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"73212dc9-be51-404b-aa49-82313e2fab06","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-29T20:21:17Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"73212dc9-be51-404b-aa49-82313e2fab06","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"54586a1f-dba1-4d97-9a45-0d94daeef113","keyName":"e2e-rate-b-c781c2","selected_subscription":"e2e-rate-iso-b-c781c2","selected_subscription_key":"ai-tenant-e2e-shared-b-1a1eaa/e2e-rate-iso-b-c781c2@ai-tenant-e2e-shared-b-1a1eaa/rate-test-model-1a1eaa","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-b-1a1eaa/models/facebook/opt-125m","name":"rate-test-model-1a1eaa","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-c781c2","namespace":"ai-tenant-e2e-shared-b-1a1eaa","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-b-1a1eaa/rate-test-model-1a1eaa"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-29T20:21:17Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"73212dc9-be51-404b-aa49-82313e2fab06","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-29T20:21:17Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"73212dc9-be51-404b-aa49-82313e2fab06","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-29T20:21:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/03c1983b72179d113fcf2c17e3965b7ac73e94c901e74876a13f20125aff0349"}
{"level":"info","ts":"2026-07-29T20:21:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/08219bf7942347fdde67cbf7428f9a5fabb7e907009bf592cc182cd8d08469b0"}
{"level":"info","ts":"2026-07-29T20:21:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7591b01ad2873206d14c4977516a543d010fba69b7834c5dbfb61273e14c0201"}
{"level":"info","ts":"2026-07-29T20:21:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/22bd17c66c232dde69242192be886df5c8a24cdfce1465d8f9aa02b07a48758d"}
{"level":"info","ts":"2026-07-29T20:21:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9bb2b36fb3dbfa08c51bb5298d9f81b31dbccc7a07b446fd48ab584c73abd485"}
{"level":"info","ts":"2026-07-29T20:21:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7634c7b6799a347598494197b05972dedf1c19e476946a8e202bdccf919d40db"}
{"level":"info","ts":"2026-07-29T20:21:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e4030fd333572aae8cc24149203db37439ac8f3058ef136636634b9f8d1653e0"}
{"level":"info","ts":"2026-07-29T20:21:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/07fca49f41acee1eb2c05ecc083dfae20f7cb685f8e2a830a236b48209d9ed25"}
{"level":"info","ts":"2026-07-29T20:21:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4be95e394b108058c458f28bcebffef90ddd35f16f8cfe3d66c09b5127b43aae"}
{"level":"info","ts":"2026-07-29T20:21:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2a339e743846c8e7814fa9e6397ef9b173c0e62bd8778b1fc2b9da4c4956f84f"}
{"level":"info","ts":"2026-07-29T20:21:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/03e41fb400a751e24bd246a2b5b21da152da6b2f177df43f5f51e5aebd149846"}
{"level":"info","ts":"2026-07-29T20:21:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/74fa6a73eb66600e4e425d2348ac0a613ab6eae00d25e14d5c393b5d3d3e38ba"}
{"level":"info","ts":"2026-07-29T20:21:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/552d09a20cc0632d74576e20e784100d8d28d71cf1f539ef061a9fda2fd647bb"}
{"level":"info","ts":"2026-07-29T20:21:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/441166825b0c027ff82cf8bb773fbddfc334f4e8f1bd4e2993d148cf0aed6e40"}
{"level":"info","ts":"2026-07-29T20:21:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f6efb8c1d58204f9b71bb1cef766a2b223ba68936dccee2613a0dc8b98171f95"}
{"level":"info","ts":"2026-07-29T20:21:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/0ea3e046a19c6fb661e8736db7c8cde227b79929f6487a1fe9a31895ffc23632"}
{"level":"info","ts":"2026-07-29T20:21:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3ac81c2e2beff0e0174736cce3305e0a4ecdbd24079d060e92c6c5e1f8a725c2"}
{"level":"info","ts":"2026-07-29T20:21:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c817087c3061294d7673bf1e0d39cc429663abf2306ab812166e43b0ea0fe289"}
{"level":"info","ts":"2026-07-29T20:21:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/57733c1504bdbd6bbb8725026a7f94a34141c5987da269371e7fce1ad91cf42f"}
{"level":"info","ts":"2026-07-29T20:21:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/859fc0c649b86dc805aeac3f7615db25ac250078fd318518a651d070f084e560"}
{"level":"info","ts":"2026-07-29T20:21:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1b0bef7d4f4a20dae9af7bb5e51fae366d09bcd535ed85c477bfba8f25b18a95"}
{"level":"info","ts":"2026-07-29T20:21:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3e617edc9e6643c7d7c211ab315bbce10e24c646cd50291c925569cb2df976a0"}
{"level":"info","ts":"2026-07-29T20:21:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/229028f95338caa29a8b1416bb1e8fce36a07ea3a941eecc36e036030bee4040"}
{"level":"info","ts":"2026-07-29T20:21:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/27e788a5304381312089b7b8b63d6f2787c9d3f8cf8a96efdf91f099b0e87718"}
{"level":"info","ts":"2026-07-29T20:22:41Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6e807dfd-3630-40b1-8ed6-b464785b1223","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:45034","PortSpecifier":{"PortValue":45034}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.50:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6e807dfd-3630-40b1-8ed6-b464785b1223","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.e7e0ef25-19c0-4a1e-b260-218071585b15.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-29T20:22:41Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6e807dfd-3630-40b1-8ed6-b464785b1223","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:45034","PortSpecifier":{"PortValue":45034}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.50:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785356561,"nanos":299091934},"http":{"id":"6e807dfd-3630-40b1-8ed6-b464785b1223","method":"POST","headers":{":authority":"maas.apps.e7e0ef25-19c0-4a1e-b260-218071585b15.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T20:22:41Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"6e807dfd-3630-40b1-8ed6-b464785b1223","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-29T20:22:41Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6e807dfd-3630-40b1-8ed6-b464785b1223","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"5a61d67c-746d-4d9a-be81-db484d5ce9f0","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=25be2bf6-b8ab-4b2e-8cad-1eabd3151489"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/218071585b15"]}}
{"level":"debug","ts":"2026-07-29T20:22:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6e807dfd-3630-40b1-8ed6-b464785b1223","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/218071585b15"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=25be2bf6-b8ab-4b2e-8cad-1eabd3151489"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"5a61d67c-746d-4d9a-be81-db484d5ce9f0","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.50:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.e7e0ef25-19c0-4a1e-b260-218071585b15.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T20:22:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6e807dfd-3630-40b1-8ed6-b464785b1223","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T20:22:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6e807dfd-3630-40b1-8ed6-b464785b1223","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T20:22:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6e807dfd-3630-40b1-8ed6-b464785b1223","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]},\"publishers/llm/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/llm/models/facebook/opt-125m-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T20:22:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"6e807dfd-3630-40b1-8ed6-b464785b1223","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-29T20:22:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6e807dfd-3630-40b1-8ed6-b464785b1223","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-29T20:22:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6e807dfd-3630-40b1-8ed6-b464785b1223","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-29T20:22:41Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6e807dfd-3630-40b1-8ed6-b464785b1223","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-29T20:22:41Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6e807dfd-3630-40b1-8ed6-b464785b1223","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-29T20:22:41Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0a3d859d-72f9-47e5-beec-9a048e051918","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:45044","PortSpecifier":{"PortValue":45044}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.50:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0a3d859d-72f9-47e5-beec-9a048e051918","method":"POST","path":"/llm/facebook-opt-125m-simulated/v1/chat/completions","host":"maas.apps.e7e0ef25-19c0-4a1e-b260-218071585b15.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-29T20:22:41Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0a3d859d-72f9-47e5-beec-9a048e051918","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:45044","PortSpecifier":{"PortValue":45044}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.50:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785356561,"nanos":350494241},"http":{"id":"0a3d859d-72f9-47e5-beec-9a048e051918","method":"POST","headers":{":authority":"maas.apps.e7e0ef25-19c0-4a1e-b260-218071585b15.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T20:22:41Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0a3d859d-72f9-47e5-beec-9a048e051918","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1IBMGIly9QyzGQ9kl_PhqSEMs8SblfR6TDHqKY0CmTrU2b5uGCHkzNJo8btVp"}
{"level":"debug","ts":"2026-07-29T20:22:41Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0a3d859d-72f9-47e5-beec-9a048e051918","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1IBMGIly9QyzGQ9kl_PhqSEMs8SblfR6TDHqKY0CmTrU2b5uGCHkzNJo8btVp\"}"}
{"level":"debug","ts":"2026-07-29T20:22:41Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0a3d859d-72f9-47e5-beec-9a048e051918","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"e0418407-160b-4c6b-9fd9-6827e20f664a","keyName":"e2e-ipp-default","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"e0418407-160b-4c6b-9fd9-6827e20f664a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-29T20:22:41Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0a3d859d-72f9-47e5-beec-9a048e051918","config":"subscription-info","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"simulator-subscription\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-29T20:22:41Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0a3d859d-72f9-47e5-beec-9a048e051918","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","model_name":"publishers/llm/models/facebook/opt-125m","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true,"resolvedModel":"llm/facebook-opt-125m-simulated"}}
{"level":"debug","ts":"2026-07-29T20:22:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0a3d859d-72f9-47e5-beec-9a048e051918","input":{"auth":{"identity":"Bearer **** subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","model_name":"publishers/llm/models/facebook/opt-125m","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true,"resolvedModel":"llm/facebook-opt-125m-simulated"}}},"context":{"context_extensions":{"host":"311b1be286674fd5684c9ac59b318287dade9769cfe4aeebd8c88e2dc6b72418"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.50:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.e7e0ef25-19c0-4a1e-b260-218071585b15.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T20:22:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0a3d859d-72f9-47e5-beec-9a048e051918","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T20:22:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0a3d859d-72f9-47e5-beec-9a048e051918","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T20:22:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0a3d859d-72f9-47e5-beec-9a048e051918","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]},\"publishers/llm/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/llm/models/facebook/opt-125m-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T20:22:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0a3d859d-72f9-47e5-beec-9a048e051918","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T20:22:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0a3d859d-72f9-47e5-beec-9a048e051918","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-29T20:22:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0a3d859d-72f9-47e5-beec-9a048e051918","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-29T20:22:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0a3d859d-72f9-47e5-beec-9a048e051918","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-29T20:22:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0a3d859d-72f9-47e5-beec-9a048e051918","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"e0418407-160b-4c6b-9fd9-6827e20f664a","keyName":"e2e-ipp-default","selected_subscription":"simulator-subscription","selected_subscription_key":"models-as-a-service/simulator-subscription@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","model_name":"publishers/llm/models/facebook/opt-125m","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true,"resolvedModel":"llm/facebook-opt-125m-simulated"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-29T20:22:41Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0a3d859d-72f9-47e5-beec-9a048e051918","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-29T20:22:41Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0a3d859d-72f9-47e5-beec-9a048e051918","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-29T20:23:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"538e148c1583998460a2c54426126683ec5461701468b9e712dd562c24d14fdb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T20:23:23Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T20:23:23Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T20:23:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"538e148c1583998460a2c54426126683ec5461701468b9e712dd562c24d14fdb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T20:23:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8ca019793cafa4d1617bb668bdb9a6d023a22af754aa7d4221c005a46917014b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T20:23:23Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T20:23:23Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T20:23:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/538e148c1583998460a2c54426126683ec5461701468b9e712dd562c24d14fdb"}
{"level":"info","ts":"2026-07-29T20:23:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8ca019793cafa4d1617bb668bdb9a6d023a22af754aa7d4221c005a46917014b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T20:23:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"538e148c1583998460a2c54426126683ec5461701468b9e712dd562c24d14fdb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T20:23:23Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T20:23:23Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["538e148c1583998460a2c54426126683ec5461701468b9e712dd562c24d14fdb"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T20:23:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"538e148c1583998460a2c54426126683ec5461701468b9e712dd562c24d14fdb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T20:23:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8ca019793cafa4d1617bb668bdb9a6d023a22af754aa7d4221c005a46917014b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T20:23:23Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T20:23:23Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T20:23:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8ca019793cafa4d1617bb668bdb9a6d023a22af754aa7d4221c005a46917014b"}
{"level":"info","ts":"2026-07-29T20:23:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8ca019793cafa4d1617bb668bdb9a6d023a22af754aa7d4221c005a46917014b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T20:23:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"538e148c1583998460a2c54426126683ec5461701468b9e712dd562c24d14fdb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T20:23:23Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T20:23:23Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T20:23:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/538e148c1583998460a2c54426126683ec5461701468b9e712dd562c24d14fdb"}
{"level":"info","ts":"2026-07-29T20:23:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"538e148c1583998460a2c54426126683ec5461701468b9e712dd562c24d14fdb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T20:23:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8ca019793cafa4d1617bb668bdb9a6d023a22af754aa7d4221c005a46917014b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T20:23:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"538e148c1583998460a2c54426126683ec5461701468b9e712dd562c24d14fdb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T20:23:23Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T20:23:23Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["538e148c1583998460a2c54426126683ec5461701468b9e712dd562c24d14fdb"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T20:23:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"538e148c1583998460a2c54426126683ec5461701468b9e712dd562c24d14fdb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T20:23:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"538e148c1583998460a2c54426126683ec5461701468b9e712dd562c24d14fdb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T20:23:23Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T20:23:23Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["538e148c1583998460a2c54426126683ec5461701468b9e712dd562c24d14fdb"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T20:23:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8ca019793cafa4d1617bb668bdb9a6d023a22af754aa7d4221c005a46917014b"}
{"level":"error","ts":"2026-07-29T20:23:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"538e148c1583998460a2c54426126683ec5461701468b9e712dd562c24d14fdb","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"538e148c1583998460a2c54426126683ec5461701468b9e712dd562c24d14fdb\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-29T20:23:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8ca019793cafa4d1617bb668bdb9a6d023a22af754aa7d4221c005a46917014b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T20:23:23Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T20:23:23Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8ca019793cafa4d1617bb668bdb9a6d023a22af754aa7d4221c005a46917014b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T20:23:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8ca019793cafa4d1617bb668bdb9a6d023a22af754aa7d4221c005a46917014b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T20:23:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"538e148c1583998460a2c54426126683ec5461701468b9e712dd562c24d14fdb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T20:23:23Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T20:23:23Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T20:23:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/538e148c1583998460a2c54426126683ec5461701468b9e712dd562c24d14fdb"}
{"level":"info","ts":"2026-07-29T20:23:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"538e148c1583998460a2c54426126683ec5461701468b9e712dd562c24d14fdb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T20:23:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"eedb7ee68a3343409d09097a08a1d4e5122576b2cf5ba333fc5dfcabcc23ffc4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T20:23:23Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T20:23:23Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T20:23:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/eedb7ee68a3343409d09097a08a1d4e5122576b2cf5ba333fc5dfcabcc23ffc4"}
{"level":"info","ts":"2026-07-29T20:23:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"eedb7ee68a3343409d09097a08a1d4e5122576b2cf5ba333fc5dfcabcc23ffc4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T20:23:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8ca019793cafa4d1617bb668bdb9a6d023a22af754aa7d4221c005a46917014b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T20:23:23Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T20:23:23Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T20:23:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8ca019793cafa4d1617bb668bdb9a6d023a22af754aa7d4221c005a46917014b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T20:23:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c77b0d52438fa6c297457f2ce9e2eb94752d686e63e2f68e497130b89dbee3cb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T20:23:23Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T20:23:23Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T20:23:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8ca019793cafa4d1617bb668bdb9a6d023a22af754aa7d4221c005a46917014b"}
{"level":"info","ts":"2026-07-29T20:23:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c77b0d52438fa6c297457f2ce9e2eb94752d686e63e2f68e497130b89dbee3cb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T20:23:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"538e148c1583998460a2c54426126683ec5461701468b9e712dd562c24d14fdb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T20:23:23Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T20:23:23Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["538e148c1583998460a2c54426126683ec5461701468b9e712dd562c24d14fdb"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T20:23:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c77b0d52438fa6c297457f2ce9e2eb94752d686e63e2f68e497130b89dbee3cb"}
{"level":"info","ts":"2026-07-29T20:23:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"538e148c1583998460a2c54426126683ec5461701468b9e712dd562c24d14fdb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T20:23:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"eedb7ee68a3343409d09097a08a1d4e5122576b2cf5ba333fc5dfcabcc23ffc4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T20:23:23Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T20:23:23Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["eedb7ee68a3343409d09097a08a1d4e5122576b2cf5ba333fc5dfcabcc23ffc4"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T20:23:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"eedb7ee68a3343409d09097a08a1d4e5122576b2cf5ba333fc5dfcabcc23ffc4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T20:23:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8ca019793cafa4d1617bb668bdb9a6d023a22af754aa7d4221c005a46917014b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T20:23:23Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T20:23:23Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8ca019793cafa4d1617bb668bdb9a6d023a22af754aa7d4221c005a46917014b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T20:23:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/538e148c1583998460a2c54426126683ec5461701468b9e712dd562c24d14fdb"}
{"level":"info","ts":"2026-07-29T20:23:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8ca019793cafa4d1617bb668bdb9a6d023a22af754aa7d4221c005a46917014b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T20:23:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c77b0d52438fa6c297457f2ce9e2eb94752d686e63e2f68e497130b89dbee3cb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T20:23:23Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T20:23:23Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c77b0d52438fa6c297457f2ce9e2eb94752d686e63e2f68e497130b89dbee3cb"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T20:23:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/eedb7ee68a3343409d09097a08a1d4e5122576b2cf5ba333fc5dfcabcc23ffc4"}
{"level":"info","ts":"2026-07-29T20:23:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c77b0d52438fa6c297457f2ce9e2eb94752d686e63e2f68e497130b89dbee3cb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T20:23:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"538e148c1583998460a2c54426126683ec5461701468b9e712dd562c24d14fdb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T20:23:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"eedb7ee68a3343409d09097a08a1d4e5122576b2cf5ba333fc5dfcabcc23ffc4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T20:23:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8ca019793cafa4d1617bb668bdb9a6d023a22af754aa7d4221c005a46917014b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T20:23:23Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T20:23:23Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T20:23:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8ca019793cafa4d1617bb668bdb9a6d023a22af754aa7d4221c005a46917014b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T20:23:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c77b0d52438fa6c297457f2ce9e2eb94752d686e63e2f68e497130b89dbee3cb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T20:23:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8ca019793cafa4d1617bb668bdb9a6d023a22af754aa7d4221c005a46917014b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T20:23:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8ca019793cafa4d1617bb668bdb9a6d023a22af754aa7d4221c005a46917014b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-29T20:23:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8ca019793cafa4d1617bb668bdb9a6d023a22af754aa7d4221c005a46917014b"}
{"level":"debug","ts":"2026-07-29T20:23:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8ca019793cafa4d1617bb668bdb9a6d023a22af754aa7d4221c005a46917014b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T20:23:23Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T20:23:23Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8ca019793cafa4d1617bb668bdb9a6d023a22af754aa7d4221c005a46917014b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T20:23:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c77b0d52438fa6c297457f2ce9e2eb94752d686e63e2f68e497130b89dbee3cb"}
{"level":"info","ts":"2026-07-29T20:23:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8ca019793cafa4d1617bb668bdb9a6d023a22af754aa7d4221c005a46917014b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T20:23:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8ca019793cafa4d1617bb668bdb9a6d023a22af754aa7d4221c005a46917014b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-29T20:23:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/538e148c1583998460a2c54426126683ec5461701468b9e712dd562c24d14fdb"}
{"level":"debug","ts":"2026-07-29T20:23:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8ba220bfad97ce20a8a1a6ba421935bf28935ebdc738f89452357e4d1347ba91","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T20:23:23Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T20:23:23Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T20:23:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8ca019793cafa4d1617bb668bdb9a6d023a22af754aa7d4221c005a46917014b"}
{"level":"info","ts":"2026-07-29T20:23:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8ba220bfad97ce20a8a1a6ba421935bf28935ebdc738f89452357e4d1347ba91","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T20:23:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8ba220bfad97ce20a8a1a6ba421935bf28935ebdc738f89452357e4d1347ba91","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T20:23:23Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T20:23:23Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T20:23:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8ba220bfad97ce20a8a1a6ba421935bf28935ebdc738f89452357e4d1347ba91","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T20:23:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8ba220bfad97ce20a8a1a6ba421935bf28935ebdc738f89452357e4d1347ba91","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T20:23:23Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T20:23:23Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T20:23:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8ba220bfad97ce20a8a1a6ba421935bf28935ebdc738f89452357e4d1347ba91"}
{"level":"error","ts":"2026-07-29T20:23:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"8ba220bfad97ce20a8a1a6ba421935bf28935ebdc738f89452357e4d1347ba91","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"8ba220bfad97ce20a8a1a6ba421935bf28935ebdc738f89452357e4d1347ba91\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-29T20:23:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8ba220bfad97ce20a8a1a6ba421935bf28935ebdc738f89452357e4d1347ba91","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T20:23:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8ba220bfad97ce20a8a1a6ba421935bf28935ebdc738f89452357e4d1347ba91","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-29T20:23:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8ba220bfad97ce20a8a1a6ba421935bf28935ebdc738f89452357e4d1347ba91"}
{"level":"debug","ts":"2026-07-29T20:23:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"60bf2b4843fdbbdffa319a626023bb177d6867848b63070f9f5f9f9e3f5dfcc8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T20:23:23Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T20:23:23Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T20:23:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"60bf2b4843fdbbdffa319a626023bb177d6867848b63070f9f5f9f9e3f5dfcc8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T20:23:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8ba220bfad97ce20a8a1a6ba421935bf28935ebdc738f89452357e4d1347ba91","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T20:23:23Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T20:23:23Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8ba220bfad97ce20a8a1a6ba421935bf28935ebdc738f89452357e4d1347ba91"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T20:23:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/60bf2b4843fdbbdffa319a626023bb177d6867848b63070f9f5f9f9e3f5dfcc8"}
{"level":"info","ts":"2026-07-29T20:23:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8ba220bfad97ce20a8a1a6ba421935bf28935ebdc738f89452357e4d1347ba91","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T20:23:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"60bf2b4843fdbbdffa319a626023bb177d6867848b63070f9f5f9f9e3f5dfcc8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T20:23:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8ba220bfad97ce20a8a1a6ba421935bf28935ebdc738f89452357e4d1347ba91","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T20:23:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"60bf2b4843fdbbdffa319a626023bb177d6867848b63070f9f5f9f9e3f5dfcc8","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-29T20:23:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/60bf2b4843fdbbdffa319a626023bb177d6867848b63070f9f5f9f9e3f5dfcc8"}
{"level":"debug","ts":"2026-07-29T20:23:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"60bf2b4843fdbbdffa319a626023bb177d6867848b63070f9f5f9f9e3f5dfcc8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T20:23:23Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T20:23:23Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["60bf2b4843fdbbdffa319a626023bb177d6867848b63070f9f5f9f9e3f5dfcc8"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T20:23:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8ba220bfad97ce20a8a1a6ba421935bf28935ebdc738f89452357e4d1347ba91"}
{"level":"info","ts":"2026-07-29T20:23:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"60bf2b4843fdbbdffa319a626023bb177d6867848b63070f9f5f9f9e3f5dfcc8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T20:23:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"60bf2b4843fdbbdffa319a626023bb177d6867848b63070f9f5f9f9e3f5dfcc8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T20:23:23Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T20:23:23Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T20:23:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"60bf2b4843fdbbdffa319a626023bb177d6867848b63070f9f5f9f9e3f5dfcc8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T20:23:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"60bf2b4843fdbbdffa319a626023bb177d6867848b63070f9f5f9f9e3f5dfcc8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T20:23:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"60bf2b4843fdbbdffa319a626023bb177d6867848b63070f9f5f9f9e3f5dfcc8","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-29T20:23:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/60bf2b4843fdbbdffa319a626023bb177d6867848b63070f9f5f9f9e3f5dfcc8"}
{"level":"debug","ts":"2026-07-29T20:23:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"60bf2b4843fdbbdffa319a626023bb177d6867848b63070f9f5f9f9e3f5dfcc8","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-29T20:23:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/60bf2b4843fdbbdffa319a626023bb177d6867848b63070f9f5f9f9e3f5dfcc8"}
{"level":"debug","ts":"2026-07-29T20:23:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"60bf2b4843fdbbdffa319a626023bb177d6867848b63070f9f5f9f9e3f5dfcc8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T20:23:23Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T20:23:23Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["60bf2b4843fdbbdffa319a626023bb177d6867848b63070f9f5f9f9e3f5dfcc8"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T20:23:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"60bf2b4843fdbbdffa319a626023bb177d6867848b63070f9f5f9f9e3f5dfcc8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T20:23:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"60bf2b4843fdbbdffa319a626023bb177d6867848b63070f9f5f9f9e3f5dfcc8","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-29T20:23:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/60bf2b4843fdbbdffa319a626023bb177d6867848b63070f9f5f9f9e3f5dfcc8"}
{"level":"debug","ts":"2026-07-29T20:23:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3be54c649bb845ebed7e4edbac5754fb85c2e7df46f9cf93d5b7862c19318cc3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T20:23:23Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T20:23:23Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T20:23:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3be54c649bb845ebed7e4edbac5754fb85c2e7df46f9cf93d5b7862c19318cc3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T20:23:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3be54c649bb845ebed7e4edbac5754fb85c2e7df46f9cf93d5b7862c19318cc3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T20:23:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3be54c649bb845ebed7e4edbac5754fb85c2e7df46f9cf93d5b7862c19318cc3","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-29T20:23:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3be54c649bb845ebed7e4edbac5754fb85c2e7df46f9cf93d5b7862c19318cc3"}
{"level":"debug","ts":"2026-07-29T20:23:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3be54c649bb845ebed7e4edbac5754fb85c2e7df46f9cf93d5b7862c19318cc3","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-29T20:23:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3be54c649bb845ebed7e4edbac5754fb85c2e7df46f9cf93d5b7862c19318cc3"}
{"level":"debug","ts":"2026-07-29T20:23:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3be54c649bb845ebed7e4edbac5754fb85c2e7df46f9cf93d5b7862c19318cc3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T20:23:24Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T20:23:24Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3be54c649bb845ebed7e4edbac5754fb85c2e7df46f9cf93d5b7862c19318cc3"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T20:23:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3be54c649bb845ebed7e4edbac5754fb85c2e7df46f9cf93d5b7862c19318cc3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T20:23:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3be54c649bb845ebed7e4edbac5754fb85c2e7df46f9cf93d5b7862c19318cc3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T20:23:24Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T20:23:24Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T20:23:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3be54c649bb845ebed7e4edbac5754fb85c2e7df46f9cf93d5b7862c19318cc3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T20:23:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6be46e6f9302c13eb6d98cfd1211d94340808255403f48309c0479a9c380a2b0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T20:23:24Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T20:23:24Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T20:23:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3be54c649bb845ebed7e4edbac5754fb85c2e7df46f9cf93d5b7862c19318cc3"}
{"level":"info","ts":"2026-07-29T20:23:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6be46e6f9302c13eb6d98cfd1211d94340808255403f48309c0479a9c380a2b0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T20:23:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3be54c649bb845ebed7e4edbac5754fb85c2e7df46f9cf93d5b7862c19318cc3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T20:23:24Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T20:23:24Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3be54c649bb845ebed7e4edbac5754fb85c2e7df46f9cf93d5b7862c19318cc3"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T20:23:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3be54c649bb845ebed7e4edbac5754fb85c2e7df46f9cf93d5b7862c19318cc3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T20:23:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6be46e6f9302c13eb6d98cfd1211d94340808255403f48309c0479a9c380a2b0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T20:23:24Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T20:23:24Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T20:23:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6be46e6f9302c13eb6d98cfd1211d94340808255403f48309c0479a9c380a2b0"}
{"level":"info","ts":"2026-07-29T20:23:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6be46e6f9302c13eb6d98cfd1211d94340808255403f48309c0479a9c380a2b0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T20:23:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3be54c649bb845ebed7e4edbac5754fb85c2e7df46f9cf93d5b7862c19318cc3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T20:23:24Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T20:23:24Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T20:23:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3be54c649bb845ebed7e4edbac5754fb85c2e7df46f9cf93d5b7862c19318cc3"}
{"level":"info","ts":"2026-07-29T20:23:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3be54c649bb845ebed7e4edbac5754fb85c2e7df46f9cf93d5b7862c19318cc3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T20:23:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6be46e6f9302c13eb6d98cfd1211d94340808255403f48309c0479a9c380a2b0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T20:23:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3be54c649bb845ebed7e4edbac5754fb85c2e7df46f9cf93d5b7862c19318cc3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T20:23:24Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T20:23:24Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3be54c649bb845ebed7e4edbac5754fb85c2e7df46f9cf93d5b7862c19318cc3"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T20:23:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3be54c649bb845ebed7e4edbac5754fb85c2e7df46f9cf93d5b7862c19318cc3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T20:23:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3be54c649bb845ebed7e4edbac5754fb85c2e7df46f9cf93d5b7862c19318cc3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T20:23:24Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T20:23:24Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3be54c649bb845ebed7e4edbac5754fb85c2e7df46f9cf93d5b7862c19318cc3"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T20:23:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6be46e6f9302c13eb6d98cfd1211d94340808255403f48309c0479a9c380a2b0"}
{"level":"error","ts":"2026-07-29T20:23:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"3be54c649bb845ebed7e4edbac5754fb85c2e7df46f9cf93d5b7862c19318cc3","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"3be54c649bb845ebed7e4edbac5754fb85c2e7df46f9cf93d5b7862c19318cc3\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-29T20:23:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6be46e6f9302c13eb6d98cfd1211d94340808255403f48309c0479a9c380a2b0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T20:23:24Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T20:23:24Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["6be46e6f9302c13eb6d98cfd1211d94340808255403f48309c0479a9c380a2b0"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T20:23:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6be46e6f9302c13eb6d98cfd1211d94340808255403f48309c0479a9c380a2b0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T20:23:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3be54c649bb845ebed7e4edbac5754fb85c2e7df46f9cf93d5b7862c19318cc3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T20:23:24Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T20:23:24Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T20:23:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3be54c649bb845ebed7e4edbac5754fb85c2e7df46f9cf93d5b7862c19318cc3"}
{"level":"info","ts":"2026-07-29T20:23:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3be54c649bb845ebed7e4edbac5754fb85c2e7df46f9cf93d5b7862c19318cc3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T20:23:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6be46e6f9302c13eb6d98cfd1211d94340808255403f48309c0479a9c380a2b0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T20:23:24Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T20:23:24Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T20:23:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6be46e6f9302c13eb6d98cfd1211d94340808255403f48309c0479a9c380a2b0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T20:23:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"99f67f359296f5a62f46b302d72bd6e64337b5fe0d2b0587e9a85d6ba612115b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T20:23:24Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T20:23:24Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T20:23:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6be46e6f9302c13eb6d98cfd1211d94340808255403f48309c0479a9c380a2b0"}
{"level":"info","ts":"2026-07-29T20:23:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"99f67f359296f5a62f46b302d72bd6e64337b5fe0d2b0587e9a85d6ba612115b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T20:23:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3be54c649bb845ebed7e4edbac5754fb85c2e7df46f9cf93d5b7862c19318cc3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T20:23:24Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T20:23:24Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3be54c649bb845ebed7e4edbac5754fb85c2e7df46f9cf93d5b7862c19318cc3"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T20:23:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3be54c649bb845ebed7e4edbac5754fb85c2e7df46f9cf93d5b7862c19318cc3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T20:23:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6be46e6f9302c13eb6d98cfd1211d94340808255403f48309c0479a9c380a2b0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T20:23:24Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T20:23:24Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["6be46e6f9302c13eb6d98cfd1211d94340808255403f48309c0479a9c380a2b0"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T20:23:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6be46e6f9302c13eb6d98cfd1211d94340808255403f48309c0479a9c380a2b0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T20:23:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"99f67f359296f5a62f46b302d72bd6e64337b5fe0d2b0587e9a85d6ba612115b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T20:23:24Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T20:23:24Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T20:23:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/99f67f359296f5a62f46b302d72bd6e64337b5fe0d2b0587e9a85d6ba612115b"}
{"level":"info","ts":"2026-07-29T20:23:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"99f67f359296f5a62f46b302d72bd6e64337b5fe0d2b0587e9a85d6ba612115b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T20:23:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3be54c649bb845ebed7e4edbac5754fb85c2e7df46f9cf93d5b7862c19318cc3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T20:23:24Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T20:23:24Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T20:23:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3be54c649bb845ebed7e4edbac5754fb85c2e7df46f9cf93d5b7862c19318cc3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T20:23:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6be46e6f9302c13eb6d98cfd1211d94340808255403f48309c0479a9c380a2b0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T20:23:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"99f67f359296f5a62f46b302d72bd6e64337b5fe0d2b0587e9a85d6ba612115b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T20:23:24Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T20:23:24Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["99f67f359296f5a62f46b302d72bd6e64337b5fe0d2b0587e9a85d6ba612115b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T20:23:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"99f67f359296f5a62f46b302d72bd6e64337b5fe0d2b0587e9a85d6ba612115b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T20:23:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3be54c649bb845ebed7e4edbac5754fb85c2e7df46f9cf93d5b7862c19318cc3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T20:23:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"99f67f359296f5a62f46b302d72bd6e64337b5fe0d2b0587e9a85d6ba612115b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T20:23:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3be54c649bb845ebed7e4edbac5754fb85c2e7df46f9cf93d5b7862c19318cc3","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-29T20:23:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3be54c649bb845ebed7e4edbac5754fb85c2e7df46f9cf93d5b7862c19318cc3"}
{"level":"debug","ts":"2026-07-29T20:23:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3be54c649bb845ebed7e4edbac5754fb85c2e7df46f9cf93d5b7862c19318cc3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T20:23:24Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T20:23:24Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3be54c649bb845ebed7e4edbac5754fb85c2e7df46f9cf93d5b7862c19318cc3"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T20:23:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6be46e6f9302c13eb6d98cfd1211d94340808255403f48309c0479a9c380a2b0"}
{"level":"info","ts":"2026-07-29T20:23:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3be54c649bb845ebed7e4edbac5754fb85c2e7df46f9cf93d5b7862c19318cc3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T20:23:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3be54c649bb845ebed7e4edbac5754fb85c2e7df46f9cf93d5b7862c19318cc3","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-29T20:23:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/99f67f359296f5a62f46b302d72bd6e64337b5fe0d2b0587e9a85d6ba612115b"}
{"level":"info","ts":"2026-07-29T20:23:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3be54c649bb845ebed7e4edbac5754fb85c2e7df46f9cf93d5b7862c19318cc3"}
{"level":"debug","ts":"2026-07-29T20:23:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"88a9ebcbc55f2927df9336d739de45b81956db52da493e321c885208ae28c22c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T20:23:24Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T20:23:24Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T20:23:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"88a9ebcbc55f2927df9336d739de45b81956db52da493e321c885208ae28c22c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T20:23:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"88a9ebcbc55f2927df9336d739de45b81956db52da493e321c885208ae28c22c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T20:23:24Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T20:23:24Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T20:23:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/88a9ebcbc55f2927df9336d739de45b81956db52da493e321c885208ae28c22c"}
{"level":"info","ts":"2026-07-29T20:23:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"88a9ebcbc55f2927df9336d739de45b81956db52da493e321c885208ae28c22c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T20:23:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"88a9ebcbc55f2927df9336d739de45b81956db52da493e321c885208ae28c22c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T20:23:24Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T20:23:24Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-29T20:23:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"88a9ebcbc55f2927df9336d739de45b81956db52da493e321c885208ae28c22c","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"88a9ebcbc55f2927df9336d739de45b81956db52da493e321c885208ae28c22c\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-29T20:23:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"88a9ebcbc55f2927df9336d739de45b81956db52da493e321c885208ae28c22c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T20:23:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"88a9ebcbc55f2927df9336d739de45b81956db52da493e321c885208ae28c22c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-29T20:23:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/88a9ebcbc55f2927df9336d739de45b81956db52da493e321c885208ae28c22c"}
{"level":"info","ts":"2026-07-29T20:23:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/88a9ebcbc55f2927df9336d739de45b81956db52da493e321c885208ae28c22c"}
{"level":"debug","ts":"2026-07-29T20:23:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f89dcb1a009d1a03736ee4c1d2485f3b94294446c0cdbe75defbc5e6f388f940","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T20:23:24Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T20:23:24Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T20:23:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f89dcb1a009d1a03736ee4c1d2485f3b94294446c0cdbe75defbc5e6f388f940","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T20:23:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1633901e2616c9633fe0fc62659c82673e3cfb9df09e2d2e58e5741df9e4f6ab","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T20:23:24Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T20:23:24Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T20:23:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f89dcb1a009d1a03736ee4c1d2485f3b94294446c0cdbe75defbc5e6f388f940"}
{"level":"info","ts":"2026-07-29T20:23:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1633901e2616c9633fe0fc62659c82673e3cfb9df09e2d2e58e5741df9e4f6ab","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T20:23:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f89dcb1a009d1a03736ee4c1d2485f3b94294446c0cdbe75defbc5e6f388f940","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T20:23:24Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T20:23:24Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["f89dcb1a009d1a03736ee4c1d2485f3b94294446c0cdbe75defbc5e6f388f940"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T20:23:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1633901e2616c9633fe0fc62659c82673e3cfb9df09e2d2e58e5741df9e4f6ab"}
{"level":"info","ts":"2026-07-29T20:23:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f89dcb1a009d1a03736ee4c1d2485f3b94294446c0cdbe75defbc5e6f388f940","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T20:23:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"88a9ebcbc55f2927df9336d739de45b81956db52da493e321c885208ae28c22c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T20:23:24Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T20:23:24Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["88a9ebcbc55f2927df9336d739de45b81956db52da493e321c885208ae28c22c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T20:23:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"88a9ebcbc55f2927df9336d739de45b81956db52da493e321c885208ae28c22c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T20:23:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1633901e2616c9633fe0fc62659c82673e3cfb9df09e2d2e58e5741df9e4f6ab","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T20:23:24Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T20:23:24Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1633901e2616c9633fe0fc62659c82673e3cfb9df09e2d2e58e5741df9e4f6ab"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T20:23:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f89dcb1a009d1a03736ee4c1d2485f3b94294446c0cdbe75defbc5e6f388f940"}
{"level":"info","ts":"2026-07-29T20:23:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1633901e2616c9633fe0fc62659c82673e3cfb9df09e2d2e58e5741df9e4f6ab","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T20:23:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f89dcb1a009d1a03736ee4c1d2485f3b94294446c0cdbe75defbc5e6f388f940","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T20:23:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"88a9ebcbc55f2927df9336d739de45b81956db52da493e321c885208ae28c22c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T20:23:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1633901e2616c9633fe0fc62659c82673e3cfb9df09e2d2e58e5741df9e4f6ab","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T20:23:24Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T20:23:24Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T20:23:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1633901e2616c9633fe0fc62659c82673e3cfb9df09e2d2e58e5741df9e4f6ab"}
{"level":"info","ts":"2026-07-29T20:23:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/88a9ebcbc55f2927df9336d739de45b81956db52da493e321c885208ae28c22c"}
{"level":"info","ts":"2026-07-29T20:23:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1633901e2616c9633fe0fc62659c82673e3cfb9df09e2d2e58e5741df9e4f6ab","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T20:23:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1633901e2616c9633fe0fc62659c82673e3cfb9df09e2d2e58e5741df9e4f6ab","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T20:23:24Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T20:23:24Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1633901e2616c9633fe0fc62659c82673e3cfb9df09e2d2e58e5741df9e4f6ab"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T20:23:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f89dcb1a009d1a03736ee4c1d2485f3b94294446c0cdbe75defbc5e6f388f940"}
{"level":"info","ts":"2026-07-29T20:23:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1633901e2616c9633fe0fc62659c82673e3cfb9df09e2d2e58e5741df9e4f6ab"}
{"level":"info","ts":"2026-07-29T20:23:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1633901e2616c9633fe0fc62659c82673e3cfb9df09e2d2e58e5741df9e4f6ab","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T20:23:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1633901e2616c9633fe0fc62659c82673e3cfb9df09e2d2e58e5741df9e4f6ab","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T20:23:24Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T20:23:24Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1633901e2616c9633fe0fc62659c82673e3cfb9df09e2d2e58e5741df9e4f6ab"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T20:23:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1633901e2616c9633fe0fc62659c82673e3cfb9df09e2d2e58e5741df9e4f6ab"}
{"level":"error","ts":"2026-07-29T20:23:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"1633901e2616c9633fe0fc62659c82673e3cfb9df09e2d2e58e5741df9e4f6ab","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"1633901e2616c9633fe0fc62659c82673e3cfb9df09e2d2e58e5741df9e4f6ab\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-29T20:23:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1633901e2616c9633fe0fc62659c82673e3cfb9df09e2d2e58e5741df9e4f6ab","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T20:23:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1633901e2616c9633fe0fc62659c82673e3cfb9df09e2d2e58e5741df9e4f6ab","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-29T20:23:41Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"99be8653-5c98-480e-b1ed-0c9dd175c816","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:44998","PortSpecifier":{"PortValue":44998}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.60:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"99be8653-5c98-480e-b1ed-0c9dd175c816","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-ipp-a-658cad.apps.e7e0ef25-19c0-4a1e-b260-218071585b15.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-29T20:23:41Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"99be8653-5c98-480e-b1ed-0c9dd175c816","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:44998","PortSpecifier":{"PortValue":44998}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.60:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785356621,"nanos":639912892},"http":{"id":"99be8653-5c98-480e-b1ed-0c9dd175c816","method":"POST","headers":{":authority":"e2e-ipp-a-658cad.apps.e7e0ef25-19c0-4a1e-b260-218071585b15.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T20:23:41Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"99be8653-5c98-480e-b1ed-0c9dd175c816","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-29T20:23:41Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"99be8653-5c98-480e-b1ed-0c9dd175c816","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"5a61d67c-746d-4d9a-be81-db484d5ce9f0","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=25be2bf6-b8ab-4b2e-8cad-1eabd3151489"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/218071585b15"]}}
{"level":"debug","ts":"2026-07-29T20:23:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"99be8653-5c98-480e-b1ed-0c9dd175c816","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/218071585b15"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=25be2bf6-b8ab-4b2e-8cad-1eabd3151489"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"5a61d67c-746d-4d9a-be81-db484d5ce9f0","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"88a9ebcbc55f2927df9336d739de45b81956db52da493e321c885208ae28c22c"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.60:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-ipp-a-658cad.apps.e7e0ef25-19c0-4a1e-b260-218071585b15.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T20:23:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"99be8653-5c98-480e-b1ed-0c9dd175c816","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T20:23:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"99be8653-5c98-480e-b1ed-0c9dd175c816","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T20:23:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"99be8653-5c98-480e-b1ed-0c9dd175c816","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-ipp-a-658cad/ipp-route-658cad\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-ipp-a-658cad/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T20:23:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"99be8653-5c98-480e-b1ed-0c9dd175c816","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-29T20:23:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"99be8653-5c98-480e-b1ed-0c9dd175c816","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-29T20:23:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"99be8653-5c98-480e-b1ed-0c9dd175c816","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-29T20:23:41Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"99be8653-5c98-480e-b1ed-0c9dd175c816","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-29T20:23:41Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"99be8653-5c98-480e-b1ed-0c9dd175c816","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-29T20:23:43Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b34feda8-3578-4d60-9636-9e2b561b7fa1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:45002","PortSpecifier":{"PortValue":45002}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.60:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b34feda8-3578-4d60-9636-9e2b561b7fa1","method":"POST","path":"/ai-tenant-e2e-ipp-a-658cad/ipp-route-658cad/v1/chat/completions","host":"e2e-ipp-a-658cad.apps.e7e0ef25-19c0-4a1e-b260-218071585b15.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-29T20:23:43Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b34feda8-3578-4d60-9636-9e2b561b7fa1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:45002","PortSpecifier":{"PortValue":45002}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.60:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785356623,"nanos":701536413},"http":{"id":"b34feda8-3578-4d60-9636-9e2b561b7fa1","method":"POST","headers":{":authority":"e2e-ipp-a-658cad.apps.e7e0ef25-19c0-4a1e-b260-218071585b15.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-ipp-a-658cad/ipp-route-658cad/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T20:23:43Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b34feda8-3578-4d60-9636-9e2b561b7fa1","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-nOlduiK3D8zQgLtW_GNZaeYyaaQ9rsD7CqvYyxGYC00S5TynBogEkNw4vni3"}
{"level":"debug","ts":"2026-07-29T20:23:43Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b34feda8-3578-4d60-9636-9e2b561b7fa1","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-ipp-a-658cad.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-nOlduiK3D8zQgLtW_GNZaeYyaaQ9rsD7CqvYyxGYC00S5TynBogEkNw4vni3\"}"}
{"level":"debug","ts":"2026-07-29T20:23:43Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b34feda8-3578-4d60-9636-9e2b561b7fa1","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-ipp-a-658cad.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"b9ded135-37f7-4817-9b71-25e9098aead5","keyName":"e2e-ipp-658cad","subscription":"ipp-route-658cad-sub","tenant":"e2e-ipp-a-658cad","userId":"b9ded135-37f7-4817-9b71-25e9098aead5","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-29T20:23:43Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b34feda8-3578-4d60-9636-9e2b561b7fa1","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-ipp-a-658cad.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-ipp-a-658cad/ipp-route-658cad\",\"requestedSubscription\":\"ipp-route-658cad-sub\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-29T20:23:43Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b34feda8-3578-4d60-9636-9e2b561b7fa1","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-ipp-a-658cad.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-ipp-a-658cad/models/facebook/opt-125m","name":"ipp-route-658cad","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"ipp-route-658cad-sub","namespace":"ai-tenant-e2e-ipp-a-658cad","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-ipp-a-658cad/ipp-route-658cad"}}
{"level":"debug","ts":"2026-07-29T20:23:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b34feda8-3578-4d60-9636-9e2b561b7fa1","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T20:23:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b34feda8-3578-4d60-9636-9e2b561b7fa1","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T20:23:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b34feda8-3578-4d60-9636-9e2b561b7fa1","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T20:23:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b34feda8-3578-4d60-9636-9e2b561b7fa1","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-ipp-a-658cad/ipp-route-658cad\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-ipp-a-658cad/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T20:23:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b34feda8-3578-4d60-9636-9e2b561b7fa1","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T20:23:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b34feda8-3578-4d60-9636-9e2b561b7fa1","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-29T20:23:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b34feda8-3578-4d60-9636-9e2b561b7fa1","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"ipp-route-658cad-sub"}
{"level":"debug","ts":"2026-07-29T20:23:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b34feda8-3578-4d60-9636-9e2b561b7fa1","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-29T20:23:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b34feda8-3578-4d60-9636-9e2b561b7fa1","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"b9ded135-37f7-4817-9b71-25e9098aead5","keyName":"e2e-ipp-658cad","selected_subscription":"ipp-route-658cad-sub","selected_subscription_key":"ai-tenant-e2e-ipp-a-658cad/ipp-route-658cad-sub@ai-tenant-e2e-ipp-a-658cad/ipp-route-658cad","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-ipp-a-658cad/models/facebook/opt-125m","name":"ipp-route-658cad","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"ipp-route-658cad-sub","namespace":"ai-tenant-e2e-ipp-a-658cad","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-ipp-a-658cad/ipp-route-658cad"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-29T20:23:43Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b34feda8-3578-4d60-9636-9e2b561b7fa1","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-29T20:23:43Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b34feda8-3578-4d60-9636-9e2b561b7fa1","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-29T20:24:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/8ba220bfad97ce20a8a1a6ba421935bf28935ebdc738f89452357e4d1347ba91"}
{"level":"info","ts":"2026-07-29T20:24:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c77b0d52438fa6c297457f2ce9e2eb94752d686e63e2f68e497130b89dbee3cb"}
{"level":"info","ts":"2026-07-29T20:24:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/8ca019793cafa4d1617bb668bdb9a6d023a22af754aa7d4221c005a46917014b"}
{"level":"info","ts":"2026-07-29T20:24:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/99f67f359296f5a62f46b302d72bd6e64337b5fe0d2b0587e9a85d6ba612115b"}
{"level":"info","ts":"2026-07-29T20:24:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/eedb7ee68a3343409d09097a08a1d4e5122576b2cf5ba333fc5dfcabcc23ffc4"}
{"level":"info","ts":"2026-07-29T20:24:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6be46e6f9302c13eb6d98cfd1211d94340808255403f48309c0479a9c380a2b0"}
{"level":"info","ts":"2026-07-29T20:24:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1633901e2616c9633fe0fc62659c82673e3cfb9df09e2d2e58e5741df9e4f6ab"}
{"level":"info","ts":"2026-07-29T20:24:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f89dcb1a009d1a03736ee4c1d2485f3b94294446c0cdbe75defbc5e6f388f940"}
{"level":"info","ts":"2026-07-29T20:24:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3be54c649bb845ebed7e4edbac5754fb85c2e7df46f9cf93d5b7862c19318cc3"}
{"level":"info","ts":"2026-07-29T20:24:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/538e148c1583998460a2c54426126683ec5461701468b9e712dd562c24d14fdb"}
{"level":"info","ts":"2026-07-29T20:24:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/60bf2b4843fdbbdffa319a626023bb177d6867848b63070f9f5f9f9e3f5dfcc8"}
{"level":"info","ts":"2026-07-29T20:24:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/88a9ebcbc55f2927df9336d739de45b81956db52da493e321c885208ae28c22c"}