{"level":"info","ts":"2026-07-21T21:45:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4f672c2cdcc1526df3d421e1d7d643464753c4f682397aaa31ad8c016c4b9d4d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T21:45:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fc7ec16ef803b9ad8b96f70509a8f61cbf15cdd74e5ce9734a9a5520e4315dff","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-21T21:45:03Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-21T21:45:03Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T21:45:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fc7ec16ef803b9ad8b96f70509a8f61cbf15cdd74e5ce9734a9a5520e4315dff"}
{"level":"info","ts":"2026-07-21T21:45:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fc7ec16ef803b9ad8b96f70509a8f61cbf15cdd74e5ce9734a9a5520e4315dff","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T21:45:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4f672c2cdcc1526df3d421e1d7d643464753c4f682397aaa31ad8c016c4b9d4d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-21T21:45:03Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-21T21:45:03Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T21:45:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4f672c2cdcc1526df3d421e1d7d643464753c4f682397aaa31ad8c016c4b9d4d"}
{"level":"info","ts":"2026-07-21T21:45:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4f672c2cdcc1526df3d421e1d7d643464753c4f682397aaa31ad8c016c4b9d4d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T21:45:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fc7ec16ef803b9ad8b96f70509a8f61cbf15cdd74e5ce9734a9a5520e4315dff","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T21:45:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4f672c2cdcc1526df3d421e1d7d643464753c4f682397aaa31ad8c016c4b9d4d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T21:45:03Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T21:45:03Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4f672c2cdcc1526df3d421e1d7d643464753c4f682397aaa31ad8c016c4b9d4d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T21:45:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4f672c2cdcc1526df3d421e1d7d643464753c4f682397aaa31ad8c016c4b9d4d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T21:45:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4f672c2cdcc1526df3d421e1d7d643464753c4f682397aaa31ad8c016c4b9d4d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T21:45:03Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T21:45:03Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4f672c2cdcc1526df3d421e1d7d643464753c4f682397aaa31ad8c016c4b9d4d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T21:45:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fc7ec16ef803b9ad8b96f70509a8f61cbf15cdd74e5ce9734a9a5520e4315dff"}
{"level":"error","ts":"2026-07-21T21:45:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"4f672c2cdcc1526df3d421e1d7d643464753c4f682397aaa31ad8c016c4b9d4d","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"4f672c2cdcc1526df3d421e1d7d643464753c4f682397aaa31ad8c016c4b9d4d\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-21T21:45:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fc7ec16ef803b9ad8b96f70509a8f61cbf15cdd74e5ce9734a9a5520e4315dff","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T21:45:03Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T21:45:03Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["fc7ec16ef803b9ad8b96f70509a8f61cbf15cdd74e5ce9734a9a5520e4315dff"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T21:45:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fc7ec16ef803b9ad8b96f70509a8f61cbf15cdd74e5ce9734a9a5520e4315dff","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T21:45:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4f672c2cdcc1526df3d421e1d7d643464753c4f682397aaa31ad8c016c4b9d4d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-21T21:45:03Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-21T21:45:03Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T21:45:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4f672c2cdcc1526df3d421e1d7d643464753c4f682397aaa31ad8c016c4b9d4d"}
{"level":"info","ts":"2026-07-21T21:45:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4f672c2cdcc1526df3d421e1d7d643464753c4f682397aaa31ad8c016c4b9d4d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T21:45:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fc7ec16ef803b9ad8b96f70509a8f61cbf15cdd74e5ce9734a9a5520e4315dff","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-21T21:45:03Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-21T21:45:03Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T21:45:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fc7ec16ef803b9ad8b96f70509a8f61cbf15cdd74e5ce9734a9a5520e4315dff","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T21:45:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9a3fd8ed6321370230efc5697d6198cafec9b1c6dd1738b1f4f46966df3d7337","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-21T21:45:03Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-21T21:45:03Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T21:45:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fc7ec16ef803b9ad8b96f70509a8f61cbf15cdd74e5ce9734a9a5520e4315dff"}
{"level":"info","ts":"2026-07-21T21:45:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9a3fd8ed6321370230efc5697d6198cafec9b1c6dd1738b1f4f46966df3d7337","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T21:45:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4f672c2cdcc1526df3d421e1d7d643464753c4f682397aaa31ad8c016c4b9d4d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T21:45:03Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T21:45:03Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4f672c2cdcc1526df3d421e1d7d643464753c4f682397aaa31ad8c016c4b9d4d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T21:45:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4f672c2cdcc1526df3d421e1d7d643464753c4f682397aaa31ad8c016c4b9d4d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T21:45:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fc7ec16ef803b9ad8b96f70509a8f61cbf15cdd74e5ce9734a9a5520e4315dff","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T21:45:03Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T21:45:03Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["fc7ec16ef803b9ad8b96f70509a8f61cbf15cdd74e5ce9734a9a5520e4315dff"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T21:45:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9a3fd8ed6321370230efc5697d6198cafec9b1c6dd1738b1f4f46966df3d7337"}
{"level":"info","ts":"2026-07-21T21:45:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fc7ec16ef803b9ad8b96f70509a8f61cbf15cdd74e5ce9734a9a5520e4315dff","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T21:45:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9a3fd8ed6321370230efc5697d6198cafec9b1c6dd1738b1f4f46966df3d7337","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T21:45:03Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T21:45:03Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9a3fd8ed6321370230efc5697d6198cafec9b1c6dd1738b1f4f46966df3d7337"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T21:45:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9a3fd8ed6321370230efc5697d6198cafec9b1c6dd1738b1f4f46966df3d7337","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T21:45:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4f672c2cdcc1526df3d421e1d7d643464753c4f682397aaa31ad8c016c4b9d4d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-21T21:45:03Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-21T21:45:03Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T21:45:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4f672c2cdcc1526df3d421e1d7d643464753c4f682397aaa31ad8c016c4b9d4d"}
{"level":"info","ts":"2026-07-21T21:45:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4f672c2cdcc1526df3d421e1d7d643464753c4f682397aaa31ad8c016c4b9d4d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T21:45:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fc7ec16ef803b9ad8b96f70509a8f61cbf15cdd74e5ce9734a9a5520e4315dff","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-21T21:45:03Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-21T21:45:03Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T21:45:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fc7ec16ef803b9ad8b96f70509a8f61cbf15cdd74e5ce9734a9a5520e4315dff","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T21:45:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9a3fd8ed6321370230efc5697d6198cafec9b1c6dd1738b1f4f46966df3d7337","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T21:45:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4f672c2cdcc1526df3d421e1d7d643464753c4f682397aaa31ad8c016c4b9d4d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T21:45:03Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T21:45:03Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4f672c2cdcc1526df3d421e1d7d643464753c4f682397aaa31ad8c016c4b9d4d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T21:45:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fc7ec16ef803b9ad8b96f70509a8f61cbf15cdd74e5ce9734a9a5520e4315dff"}
{"level":"info","ts":"2026-07-21T21:45:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4f672c2cdcc1526df3d421e1d7d643464753c4f682397aaa31ad8c016c4b9d4d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T21:45:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e79300c14c39968a050e7fdb53f3a26106a5d07ad197b569db45b6631039faaa","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-21T21:45:03Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-21T21:45:03Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T21:45:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e79300c14c39968a050e7fdb53f3a26106a5d07ad197b569db45b6631039faaa","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T21:45:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fc7ec16ef803b9ad8b96f70509a8f61cbf15cdd74e5ce9734a9a5520e4315dff","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T21:45:03Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T21:45:03Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["fc7ec16ef803b9ad8b96f70509a8f61cbf15cdd74e5ce9734a9a5520e4315dff"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T21:45:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9a3fd8ed6321370230efc5697d6198cafec9b1c6dd1738b1f4f46966df3d7337"}
{"level":"info","ts":"2026-07-21T21:45:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fc7ec16ef803b9ad8b96f70509a8f61cbf15cdd74e5ce9734a9a5520e4315dff","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T21:45:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4f672c2cdcc1526df3d421e1d7d643464753c4f682397aaa31ad8c016c4b9d4d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-21T21:45:03Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-21T21:45:03Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T21:45:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4f672c2cdcc1526df3d421e1d7d643464753c4f682397aaa31ad8c016c4b9d4d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T21:45:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e79300c14c39968a050e7fdb53f3a26106a5d07ad197b569db45b6631039faaa","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T21:45:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fc7ec16ef803b9ad8b96f70509a8f61cbf15cdd74e5ce9734a9a5520e4315dff","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T21:45:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4f672c2cdcc1526df3d421e1d7d643464753c4f682397aaa31ad8c016c4b9d4d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-21T21:45:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4f672c2cdcc1526df3d421e1d7d643464753c4f682397aaa31ad8c016c4b9d4d"}
{"level":"debug","ts":"2026-07-21T21:45:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4f672c2cdcc1526df3d421e1d7d643464753c4f682397aaa31ad8c016c4b9d4d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T21:45:03Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T21:45:03Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4f672c2cdcc1526df3d421e1d7d643464753c4f682397aaa31ad8c016c4b9d4d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T21:45:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4f672c2cdcc1526df3d421e1d7d643464753c4f682397aaa31ad8c016c4b9d4d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T21:45:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e79300c14c39968a050e7fdb53f3a26106a5d07ad197b569db45b6631039faaa","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-21T21:45:03Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-21T21:45:03Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T21:45:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e79300c14c39968a050e7fdb53f3a26106a5d07ad197b569db45b6631039faaa"}
{"level":"info","ts":"2026-07-21T21:45:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e79300c14c39968a050e7fdb53f3a26106a5d07ad197b569db45b6631039faaa","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T21:45:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4f672c2cdcc1526df3d421e1d7d643464753c4f682397aaa31ad8c016c4b9d4d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T21:45:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e79300c14c39968a050e7fdb53f3a26106a5d07ad197b569db45b6631039faaa","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T21:45:03Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T21:45:03Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e79300c14c39968a050e7fdb53f3a26106a5d07ad197b569db45b6631039faaa"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T21:45:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fc7ec16ef803b9ad8b96f70509a8f61cbf15cdd74e5ce9734a9a5520e4315dff"}
{"level":"info","ts":"2026-07-21T21:45:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e79300c14c39968a050e7fdb53f3a26106a5d07ad197b569db45b6631039faaa","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T21:45:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e79300c14c39968a050e7fdb53f3a26106a5d07ad197b569db45b6631039faaa","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T21:45:03Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T21:45:03Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e79300c14c39968a050e7fdb53f3a26106a5d07ad197b569db45b6631039faaa"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T21:45:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4f672c2cdcc1526df3d421e1d7d643464753c4f682397aaa31ad8c016c4b9d4d"}
{"level":"info","ts":"2026-07-21T21:45:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e79300c14c39968a050e7fdb53f3a26106a5d07ad197b569db45b6631039faaa"}
{"level":"error","ts":"2026-07-21T21:45:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"e79300c14c39968a050e7fdb53f3a26106a5d07ad197b569db45b6631039faaa","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"e79300c14c39968a050e7fdb53f3a26106a5d07ad197b569db45b6631039faaa\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-21T21:45:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e79300c14c39968a050e7fdb53f3a26106a5d07ad197b569db45b6631039faaa","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T21:45:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e79300c14c39968a050e7fdb53f3a26106a5d07ad197b569db45b6631039faaa","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T21:45:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"350355a2450c1e457759488252d4bcc84bc412e2ac328741ee97154e4ef15c17","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-21T21:45:03Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-21T21:45:03Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T21:45:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/350355a2450c1e457759488252d4bcc84bc412e2ac328741ee97154e4ef15c17"}
{"level":"info","ts":"2026-07-21T21:45:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"350355a2450c1e457759488252d4bcc84bc412e2ac328741ee97154e4ef15c17","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T21:45:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"350355a2450c1e457759488252d4bcc84bc412e2ac328741ee97154e4ef15c17","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T21:45:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"350355a2450c1e457759488252d4bcc84bc412e2ac328741ee97154e4ef15c17","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T21:45:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"350355a2450c1e457759488252d4bcc84bc412e2ac328741ee97154e4ef15c17","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-21T21:45:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/350355a2450c1e457759488252d4bcc84bc412e2ac328741ee97154e4ef15c17"}
{"level":"debug","ts":"2026-07-21T21:45:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ee9152050969e08dceba0086ad122b7439ef2a73e6b91bd9f76c1f78591fbeb1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-21T21:45:03Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-21T21:45:03Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T21:45:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ee9152050969e08dceba0086ad122b7439ef2a73e6b91bd9f76c1f78591fbeb1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T21:45:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"350355a2450c1e457759488252d4bcc84bc412e2ac328741ee97154e4ef15c17","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T21:45:03Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T21:45:03Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["350355a2450c1e457759488252d4bcc84bc412e2ac328741ee97154e4ef15c17"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T21:45:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ee9152050969e08dceba0086ad122b7439ef2a73e6b91bd9f76c1f78591fbeb1"}
{"level":"info","ts":"2026-07-21T21:45:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"350355a2450c1e457759488252d4bcc84bc412e2ac328741ee97154e4ef15c17","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T21:45:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4ae379c879f1ea7d7698a04c447c796690d276dbecb0425260b6b8b40c85eaea","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-21T21:45:03Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-21T21:45:03Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T21:45:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4ae379c879f1ea7d7698a04c447c796690d276dbecb0425260b6b8b40c85eaea"}
{"level":"info","ts":"2026-07-21T21:45:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4ae379c879f1ea7d7698a04c447c796690d276dbecb0425260b6b8b40c85eaea","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T21:45:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ee9152050969e08dceba0086ad122b7439ef2a73e6b91bd9f76c1f78591fbeb1","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-21T21:45:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ee9152050969e08dceba0086ad122b7439ef2a73e6b91bd9f76c1f78591fbeb1"}
{"level":"debug","ts":"2026-07-21T21:45:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ae3b03beb6ea2e155c14218f43e2c0f70c9a402f95681179ae16da400a98cf79","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-21T21:45:03Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-21T21:45:03Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T21:45:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ae3b03beb6ea2e155c14218f43e2c0f70c9a402f95681179ae16da400a98cf79","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T21:45:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"350355a2450c1e457759488252d4bcc84bc412e2ac328741ee97154e4ef15c17","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T21:45:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fe70108dc426a0506f24819396b7d387241ed4a4f93ce861260ced6a4c9f552c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-21T21:45:03Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-21T21:45:03Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T21:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ae3b03beb6ea2e155c14218f43e2c0f70c9a402f95681179ae16da400a98cf79"}
{"level":"info","ts":"2026-07-21T21:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/350355a2450c1e457759488252d4bcc84bc412e2ac328741ee97154e4ef15c17"}
{"level":"info","ts":"2026-07-21T21:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fe70108dc426a0506f24819396b7d387241ed4a4f93ce861260ced6a4c9f552c"}
{"level":"info","ts":"2026-07-21T21:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fe70108dc426a0506f24819396b7d387241ed4a4f93ce861260ced6a4c9f552c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T21:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4ae379c879f1ea7d7698a04c447c796690d276dbecb0425260b6b8b40c85eaea","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T21:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fadf2ef0b02aa259c113f0684f8cac3a4eccee0437cbf5761aebdd7ca8bf9867","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-21T21:45:04Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-21T21:45:04Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T21:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4ae379c879f1ea7d7698a04c447c796690d276dbecb0425260b6b8b40c85eaea"}
{"level":"info","ts":"2026-07-21T21:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fadf2ef0b02aa259c113f0684f8cac3a4eccee0437cbf5761aebdd7ca8bf9867"}
{"level":"info","ts":"2026-07-21T21:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fadf2ef0b02aa259c113f0684f8cac3a4eccee0437cbf5761aebdd7ca8bf9867","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T21:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ee9152050969e08dceba0086ad122b7439ef2a73e6b91bd9f76c1f78591fbeb1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T21:45:04Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T21:45:04Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ee9152050969e08dceba0086ad122b7439ef2a73e6b91bd9f76c1f78591fbeb1"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T21:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/15703863ca9027f27616c402c60e788b5ab1f3b7e6bf16cc9e69a95e65ccdf59"}
{"level":"info","ts":"2026-07-21T21:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4bec0f4a02137ec8564b74ba793685cb5e13b484414c385b6b09b4e2de36c997"}
{"level":"info","ts":"2026-07-21T21:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ae3b03beb6ea2e155c14218f43e2c0f70c9a402f95681179ae16da400a98cf79"}
{"level":"info","ts":"2026-07-21T21:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ee9152050969e08dceba0086ad122b7439ef2a73e6b91bd9f76c1f78591fbeb1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T21:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"15703863ca9027f27616c402c60e788b5ab1f3b7e6bf16cc9e69a95e65ccdf59","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T21:45:04Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T21:45:04Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["15703863ca9027f27616c402c60e788b5ab1f3b7e6bf16cc9e69a95e65ccdf59"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T21:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c5e5ceb446a26f012c2108544e889774c7866da5b6abca9c5e91edfbf66df930"}
{"level":"info","ts":"2026-07-21T21:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fe70108dc426a0506f24819396b7d387241ed4a4f93ce861260ced6a4c9f552c"}
{"level":"info","ts":"2026-07-21T21:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"15703863ca9027f27616c402c60e788b5ab1f3b7e6bf16cc9e69a95e65ccdf59","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T21:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4bec0f4a02137ec8564b74ba793685cb5e13b484414c385b6b09b4e2de36c997","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T21:45:04Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T21:45:04Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4bec0f4a02137ec8564b74ba793685cb5e13b484414c385b6b09b4e2de36c997"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T21:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/87ca87d07b6391e36fc75ad181d56bde5e1de4f985d1348bbc158412ac6c92c2"}
{"level":"info","ts":"2026-07-21T21:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/df1fe84468de7eadf9fad76e43b03e31262f2010d1ec2fe81d8ccc4db64d1701"}
{"level":"info","ts":"2026-07-21T21:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0e1ed1f5082bc96ef0e238db573c7a491fedc76ecc7f6cf790b8fa674dc24ece"}
{"level":"info","ts":"2026-07-21T21:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4bec0f4a02137ec8564b74ba793685cb5e13b484414c385b6b09b4e2de36c997","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T21:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ae3b03beb6ea2e155c14218f43e2c0f70c9a402f95681179ae16da400a98cf79","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T21:45:04Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T21:45:04Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ae3b03beb6ea2e155c14218f43e2c0f70c9a402f95681179ae16da400a98cf79"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T21:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/302e1dc0be19aaa1ce92c7f02777c4c429bf7dc3006e0230b05949b46cedb38a"}
{"level":"info","ts":"2026-07-21T21:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fadf2ef0b02aa259c113f0684f8cac3a4eccee0437cbf5761aebdd7ca8bf9867"}
{"level":"info","ts":"2026-07-21T21:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ae3b03beb6ea2e155c14218f43e2c0f70c9a402f95681179ae16da400a98cf79","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T21:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c5e5ceb446a26f012c2108544e889774c7866da5b6abca9c5e91edfbf66df930","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T21:45:04Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T21:45:04Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c5e5ceb446a26f012c2108544e889774c7866da5b6abca9c5e91edfbf66df930"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T21:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/67ba7d4a4e0750c8cefc0ac1bb91628e22c5c56fc2b85ae3b2b020cb93e22d04"}
{"level":"info","ts":"2026-07-21T21:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ee9152050969e08dceba0086ad122b7439ef2a73e6b91bd9f76c1f78591fbeb1"}
{"level":"info","ts":"2026-07-21T21:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/00c2e4e88205a2a311ac4b99a87d2ef95622f0c880d3a4c486c63f3ae6faa0c7"}
{"level":"info","ts":"2026-07-21T21:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c5e5ceb446a26f012c2108544e889774c7866da5b6abca9c5e91edfbf66df930","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T21:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fe70108dc426a0506f24819396b7d387241ed4a4f93ce861260ced6a4c9f552c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T21:45:04Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T21:45:04Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["fe70108dc426a0506f24819396b7d387241ed4a4f93ce861260ced6a4c9f552c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T21:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3a07b1d8ecc43bd9cfaee018e614c34380109af366b8f3ef7948d4bd72639e1c"}
{"level":"info","ts":"2026-07-21T21:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1320feba8517528c67ca3e619ad255d6442ef38867fe4bbc9d034e5c18a89a19"}
{"level":"info","ts":"2026-07-21T21:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/15703863ca9027f27616c402c60e788b5ab1f3b7e6bf16cc9e69a95e65ccdf59"}
{"level":"info","ts":"2026-07-21T21:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fe70108dc426a0506f24819396b7d387241ed4a4f93ce861260ced6a4c9f552c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T21:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"87ca87d07b6391e36fc75ad181d56bde5e1de4f985d1348bbc158412ac6c92c2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T21:45:04Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T21:45:04Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["87ca87d07b6391e36fc75ad181d56bde5e1de4f985d1348bbc158412ac6c92c2"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T21:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4bec0f4a02137ec8564b74ba793685cb5e13b484414c385b6b09b4e2de36c997"}
{"level":"info","ts":"2026-07-21T21:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ae3b03beb6ea2e155c14218f43e2c0f70c9a402f95681179ae16da400a98cf79"}
{"level":"info","ts":"2026-07-21T21:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"87ca87d07b6391e36fc75ad181d56bde5e1de4f985d1348bbc158412ac6c92c2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T21:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4ae379c879f1ea7d7698a04c447c796690d276dbecb0425260b6b8b40c85eaea","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T21:45:04Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T21:45:04Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4ae379c879f1ea7d7698a04c447c796690d276dbecb0425260b6b8b40c85eaea"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T21:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c5e5ceb446a26f012c2108544e889774c7866da5b6abca9c5e91edfbf66df930"}
{"level":"info","ts":"2026-07-21T21:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fe70108dc426a0506f24819396b7d387241ed4a4f93ce861260ced6a4c9f552c"}
{"level":"info","ts":"2026-07-21T21:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4ae379c879f1ea7d7698a04c447c796690d276dbecb0425260b6b8b40c85eaea","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T21:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"df1fe84468de7eadf9fad76e43b03e31262f2010d1ec2fe81d8ccc4db64d1701","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T21:45:04Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T21:45:04Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["df1fe84468de7eadf9fad76e43b03e31262f2010d1ec2fe81d8ccc4db64d1701"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T21:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/87ca87d07b6391e36fc75ad181d56bde5e1de4f985d1348bbc158412ac6c92c2"}
{"level":"info","ts":"2026-07-21T21:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4ae379c879f1ea7d7698a04c447c796690d276dbecb0425260b6b8b40c85eaea"}
{"level":"info","ts":"2026-07-21T21:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"df1fe84468de7eadf9fad76e43b03e31262f2010d1ec2fe81d8ccc4db64d1701","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T21:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0e1ed1f5082bc96ef0e238db573c7a491fedc76ecc7f6cf790b8fa674dc24ece","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T21:45:04Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T21:45:04Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["0e1ed1f5082bc96ef0e238db573c7a491fedc76ecc7f6cf790b8fa674dc24ece"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T21:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/df1fe84468de7eadf9fad76e43b03e31262f2010d1ec2fe81d8ccc4db64d1701"}
{"level":"info","ts":"2026-07-21T21:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0e1ed1f5082bc96ef0e238db573c7a491fedc76ecc7f6cf790b8fa674dc24ece","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T21:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"302e1dc0be19aaa1ce92c7f02777c4c429bf7dc3006e0230b05949b46cedb38a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T21:45:04Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T21:45:04Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["302e1dc0be19aaa1ce92c7f02777c4c429bf7dc3006e0230b05949b46cedb38a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T21:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0e1ed1f5082bc96ef0e238db573c7a491fedc76ecc7f6cf790b8fa674dc24ece"}
{"level":"info","ts":"2026-07-21T21:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"302e1dc0be19aaa1ce92c7f02777c4c429bf7dc3006e0230b05949b46cedb38a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T21:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fadf2ef0b02aa259c113f0684f8cac3a4eccee0437cbf5761aebdd7ca8bf9867","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T21:45:04Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T21:45:04Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["fadf2ef0b02aa259c113f0684f8cac3a4eccee0437cbf5761aebdd7ca8bf9867"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T21:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/302e1dc0be19aaa1ce92c7f02777c4c429bf7dc3006e0230b05949b46cedb38a"}
{"level":"info","ts":"2026-07-21T21:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fadf2ef0b02aa259c113f0684f8cac3a4eccee0437cbf5761aebdd7ca8bf9867","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T21:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"67ba7d4a4e0750c8cefc0ac1bb91628e22c5c56fc2b85ae3b2b020cb93e22d04","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T21:45:04Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T21:45:04Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["67ba7d4a4e0750c8cefc0ac1bb91628e22c5c56fc2b85ae3b2b020cb93e22d04"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T21:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fadf2ef0b02aa259c113f0684f8cac3a4eccee0437cbf5761aebdd7ca8bf9867"}
{"level":"info","ts":"2026-07-21T21:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"67ba7d4a4e0750c8cefc0ac1bb91628e22c5c56fc2b85ae3b2b020cb93e22d04","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T21:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ee9152050969e08dceba0086ad122b7439ef2a73e6b91bd9f76c1f78591fbeb1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T21:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"00c2e4e88205a2a311ac4b99a87d2ef95622f0c880d3a4c486c63f3ae6faa0c7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T21:45:04Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T21:45:04Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["00c2e4e88205a2a311ac4b99a87d2ef95622f0c880d3a4c486c63f3ae6faa0c7"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T21:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/67ba7d4a4e0750c8cefc0ac1bb91628e22c5c56fc2b85ae3b2b020cb93e22d04"}
{"level":"info","ts":"2026-07-21T21:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"00c2e4e88205a2a311ac4b99a87d2ef95622f0c880d3a4c486c63f3ae6faa0c7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T21:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3a07b1d8ecc43bd9cfaee018e614c34380109af366b8f3ef7948d4bd72639e1c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T21:45:04Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T21:45:04Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3a07b1d8ecc43bd9cfaee018e614c34380109af366b8f3ef7948d4bd72639e1c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T21:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/00c2e4e88205a2a311ac4b99a87d2ef95622f0c880d3a4c486c63f3ae6faa0c7"}
{"level":"info","ts":"2026-07-21T21:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3a07b1d8ecc43bd9cfaee018e614c34380109af366b8f3ef7948d4bd72639e1c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T21:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1320feba8517528c67ca3e619ad255d6442ef38867fe4bbc9d034e5c18a89a19","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T21:45:04Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T21:45:04Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1320feba8517528c67ca3e619ad255d6442ef38867fe4bbc9d034e5c18a89a19"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T21:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3a07b1d8ecc43bd9cfaee018e614c34380109af366b8f3ef7948d4bd72639e1c"}
{"level":"info","ts":"2026-07-21T21:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1320feba8517528c67ca3e619ad255d6442ef38867fe4bbc9d034e5c18a89a19","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T21:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"15703863ca9027f27616c402c60e788b5ab1f3b7e6bf16cc9e69a95e65ccdf59","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T21:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4bec0f4a02137ec8564b74ba793685cb5e13b484414c385b6b09b4e2de36c997","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T21:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ae3b03beb6ea2e155c14218f43e2c0f70c9a402f95681179ae16da400a98cf79","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T21:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c5e5ceb446a26f012c2108544e889774c7866da5b6abca9c5e91edfbf66df930","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T21:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fe70108dc426a0506f24819396b7d387241ed4a4f93ce861260ced6a4c9f552c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T21:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"87ca87d07b6391e36fc75ad181d56bde5e1de4f985d1348bbc158412ac6c92c2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T21:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4ae379c879f1ea7d7698a04c447c796690d276dbecb0425260b6b8b40c85eaea","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T21:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"df1fe84468de7eadf9fad76e43b03e31262f2010d1ec2fe81d8ccc4db64d1701","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T21:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0e1ed1f5082bc96ef0e238db573c7a491fedc76ecc7f6cf790b8fa674dc24ece","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T21:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"302e1dc0be19aaa1ce92c7f02777c4c429bf7dc3006e0230b05949b46cedb38a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T21:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fadf2ef0b02aa259c113f0684f8cac3a4eccee0437cbf5761aebdd7ca8bf9867","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T21:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"67ba7d4a4e0750c8cefc0ac1bb91628e22c5c56fc2b85ae3b2b020cb93e22d04","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T21:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"00c2e4e88205a2a311ac4b99a87d2ef95622f0c880d3a4c486c63f3ae6faa0c7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T21:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3a07b1d8ecc43bd9cfaee018e614c34380109af366b8f3ef7948d4bd72639e1c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T21:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1320feba8517528c67ca3e619ad255d6442ef38867fe4bbc9d034e5c18a89a19","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-21T21:45:04Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-21T21:45:04Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T21:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1320feba8517528c67ca3e619ad255d6442ef38867fe4bbc9d034e5c18a89a19"}
{"level":"info","ts":"2026-07-21T21:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1320feba8517528c67ca3e619ad255d6442ef38867fe4bbc9d034e5c18a89a19","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T21:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1320feba8517528c67ca3e619ad255d6442ef38867fe4bbc9d034e5c18a89a19","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T21:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1320feba8517528c67ca3e619ad255d6442ef38867fe4bbc9d034e5c18a89a19","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-21T21:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1320feba8517528c67ca3e619ad255d6442ef38867fe4bbc9d034e5c18a89a19"}
{"level":"debug","ts":"2026-07-21T21:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1320feba8517528c67ca3e619ad255d6442ef38867fe4bbc9d034e5c18a89a19","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T21:45:04Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T21:45:04Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1320feba8517528c67ca3e619ad255d6442ef38867fe4bbc9d034e5c18a89a19"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T21:45:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1320feba8517528c67ca3e619ad255d6442ef38867fe4bbc9d034e5c18a89a19","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T21:45:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1320feba8517528c67ca3e619ad255d6442ef38867fe4bbc9d034e5c18a89a19","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-21T21:45:05Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-21T21:45:05Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T21:45:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1320feba8517528c67ca3e619ad255d6442ef38867fe4bbc9d034e5c18a89a19"}
{"level":"info","ts":"2026-07-21T21:45:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1320feba8517528c67ca3e619ad255d6442ef38867fe4bbc9d034e5c18a89a19","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T21:45:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1320feba8517528c67ca3e619ad255d6442ef38867fe4bbc9d034e5c18a89a19","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T21:45:05Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T21:45:05Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1320feba8517528c67ca3e619ad255d6442ef38867fe4bbc9d034e5c18a89a19"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T21:45:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1320feba8517528c67ca3e619ad255d6442ef38867fe4bbc9d034e5c18a89a19"}
{"level":"info","ts":"2026-07-21T21:45:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1320feba8517528c67ca3e619ad255d6442ef38867fe4bbc9d034e5c18a89a19","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T21:45:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1320feba8517528c67ca3e619ad255d6442ef38867fe4bbc9d034e5c18a89a19","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T21:45:05Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T21:45:05Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1320feba8517528c67ca3e619ad255d6442ef38867fe4bbc9d034e5c18a89a19"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-21T21:45:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"1320feba8517528c67ca3e619ad255d6442ef38867fe4bbc9d034e5c18a89a19","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"1320feba8517528c67ca3e619ad255d6442ef38867fe4bbc9d034e5c18a89a19\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-21T21:45:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1320feba8517528c67ca3e619ad255d6442ef38867fe4bbc9d034e5c18a89a19","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-21T21:45:05Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-21T21:45:05Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T21:45:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1320feba8517528c67ca3e619ad255d6442ef38867fe4bbc9d034e5c18a89a19"}
{"level":"info","ts":"2026-07-21T21:45:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1320feba8517528c67ca3e619ad255d6442ef38867fe4bbc9d034e5c18a89a19","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T21:45:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1320feba8517528c67ca3e619ad255d6442ef38867fe4bbc9d034e5c18a89a19","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T21:45:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1320feba8517528c67ca3e619ad255d6442ef38867fe4bbc9d034e5c18a89a19","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T21:45:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1320feba8517528c67ca3e619ad255d6442ef38867fe4bbc9d034e5c18a89a19","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T21:45:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1320feba8517528c67ca3e619ad255d6442ef38867fe4bbc9d034e5c18a89a19","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-21T21:45:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1320feba8517528c67ca3e619ad255d6442ef38867fe4bbc9d034e5c18a89a19"}
{"level":"debug","ts":"2026-07-21T21:45:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1320feba8517528c67ca3e619ad255d6442ef38867fe4bbc9d034e5c18a89a19","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T21:45:05Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T21:45:05Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1320feba8517528c67ca3e619ad255d6442ef38867fe4bbc9d034e5c18a89a19"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T21:45:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1320feba8517528c67ca3e619ad255d6442ef38867fe4bbc9d034e5c18a89a19","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T21:45:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1320feba8517528c67ca3e619ad255d6442ef38867fe4bbc9d034e5c18a89a19","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-21T21:45:05Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-21T21:45:05Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T21:45:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1320feba8517528c67ca3e619ad255d6442ef38867fe4bbc9d034e5c18a89a19"}
{"level":"info","ts":"2026-07-21T21:45:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1320feba8517528c67ca3e619ad255d6442ef38867fe4bbc9d034e5c18a89a19","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T21:45:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1320feba8517528c67ca3e619ad255d6442ef38867fe4bbc9d034e5c18a89a19","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T21:45:05Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T21:45:05Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1320feba8517528c67ca3e619ad255d6442ef38867fe4bbc9d034e5c18a89a19"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T21:45:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1320feba8517528c67ca3e619ad255d6442ef38867fe4bbc9d034e5c18a89a19"}
{"level":"info","ts":"2026-07-21T21:45:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1320feba8517528c67ca3e619ad255d6442ef38867fe4bbc9d034e5c18a89a19","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T21:45:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1320feba8517528c67ca3e619ad255d6442ef38867fe4bbc9d034e5c18a89a19","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T21:45:05Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T21:45:05Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1320feba8517528c67ca3e619ad255d6442ef38867fe4bbc9d034e5c18a89a19"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T21:45:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1320feba8517528c67ca3e619ad255d6442ef38867fe4bbc9d034e5c18a89a19"}
{"level":"error","ts":"2026-07-21T21:45:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"1320feba8517528c67ca3e619ad255d6442ef38867fe4bbc9d034e5c18a89a19","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"1320feba8517528c67ca3e619ad255d6442ef38867fe4bbc9d034e5c18a89a19\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-21T21:45:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1320feba8517528c67ca3e619ad255d6442ef38867fe4bbc9d034e5c18a89a19","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T21:45:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1320feba8517528c67ca3e619ad255d6442ef38867fe4bbc9d034e5c18a89a19","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-21T21:45:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0380dc0d-3b90-42ef-a57b-4a09fec1a262","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.11:39576","PortSpecifier":{"PortValue":39576}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.61:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0380dc0d-3b90-42ef-a57b-4a09fec1a262","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-e584ac.apps.0882b177-5f5b-40a6-aa64-03f78bfa7495.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-21T21:45:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0380dc0d-3b90-42ef-a57b-4a09fec1a262","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.11:39576","PortSpecifier":{"PortValue":39576}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.61:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784670309,"nanos":321641965},"http":{"id":"0380dc0d-3b90-42ef-a57b-4a09fec1a262","method":"POST","headers":{":authority":"e2e-shared-a-e584ac.apps.0882b177-5f5b-40a6-aa64-03f78bfa7495.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T21:45:09Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"0380dc0d-3b90-42ef-a57b-4a09fec1a262","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-21T21:45:09Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0380dc0d-3b90-42ef-a57b-4a09fec1a262","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"53006d43-ceb2-495a-b14f-38750ec9f735","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=8bf6eb0b-9752-4b55-aa51-fd32da69924a"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/03f78bfa7495"]}}
{"level":"debug","ts":"2026-07-21T21:45:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0380dc0d-3b90-42ef-a57b-4a09fec1a262","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/03f78bfa7495"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=8bf6eb0b-9752-4b55-aa51-fd32da69924a"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"53006d43-ceb2-495a-b14f-38750ec9f735","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"3a07b1d8ecc43bd9cfaee018e614c34380109af366b8f3ef7948d4bd72639e1c"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.61:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-e584ac.apps.0882b177-5f5b-40a6-aa64-03f78bfa7495.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T21:45:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0380dc0d-3b90-42ef-a57b-4a09fec1a262","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T21:45:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0380dc0d-3b90-42ef-a57b-4a09fec1a262","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T21:45:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0380dc0d-3b90-42ef-a57b-4a09fec1a262","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e584ac/rate-test-model-e584ac\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-e584ac/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T21:45:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"0380dc0d-3b90-42ef-a57b-4a09fec1a262","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-21T21:45:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0380dc0d-3b90-42ef-a57b-4a09fec1a262","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-21T21:45:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0380dc0d-3b90-42ef-a57b-4a09fec1a262","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-21T21:45:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0380dc0d-3b90-42ef-a57b-4a09fec1a262","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-21T21:45:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0380dc0d-3b90-42ef-a57b-4a09fec1a262","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-21T21:45:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"df9b7061-02aa-408a-90d3-aa2923c0f301","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.11:53052","PortSpecifier":{"PortValue":53052}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.62:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"df9b7061-02aa-408a-90d3-aa2923c0f301","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-24ec74.apps.0882b177-5f5b-40a6-aa64-03f78bfa7495.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-21T21:45:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"df9b7061-02aa-408a-90d3-aa2923c0f301","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.11:53052","PortSpecifier":{"PortValue":53052}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.62:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784670309,"nanos":362354981},"http":{"id":"df9b7061-02aa-408a-90d3-aa2923c0f301","method":"POST","headers":{":authority":"e2e-shared-b-24ec74.apps.0882b177-5f5b-40a6-aa64-03f78bfa7495.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T21:45:09Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"df9b7061-02aa-408a-90d3-aa2923c0f301","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-21T21:45:09Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"df9b7061-02aa-408a-90d3-aa2923c0f301","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"53006d43-ceb2-495a-b14f-38750ec9f735","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=8bf6eb0b-9752-4b55-aa51-fd32da69924a"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/03f78bfa7495"]}}
{"level":"debug","ts":"2026-07-21T21:45:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"df9b7061-02aa-408a-90d3-aa2923c0f301","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/03f78bfa7495"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=8bf6eb0b-9752-4b55-aa51-fd32da69924a"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"53006d43-ceb2-495a-b14f-38750ec9f735","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"15703863ca9027f27616c402c60e788b5ab1f3b7e6bf16cc9e69a95e65ccdf59"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.62:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-24ec74.apps.0882b177-5f5b-40a6-aa64-03f78bfa7495.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T21:45:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"df9b7061-02aa-408a-90d3-aa2923c0f301","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T21:45:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"df9b7061-02aa-408a-90d3-aa2923c0f301","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T21:45:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"df9b7061-02aa-408a-90d3-aa2923c0f301","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-24ec74/rate-test-model-24ec74\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-24ec74/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T21:45:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"df9b7061-02aa-408a-90d3-aa2923c0f301","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-21T21:45:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"df9b7061-02aa-408a-90d3-aa2923c0f301","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-21T21:45:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"df9b7061-02aa-408a-90d3-aa2923c0f301","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-21T21:45:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"df9b7061-02aa-408a-90d3-aa2923c0f301","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-21T21:45:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"df9b7061-02aa-408a-90d3-aa2923c0f301","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-21T21:45:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"004535dc-5c7a-42f2-a36a-2561b03cae76","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.11:39582","PortSpecifier":{"PortValue":39582}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.61:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"004535dc-5c7a-42f2-a36a-2561b03cae76","method":"POST","path":"/ai-tenant-e2e-shared-a-e584ac/rate-test-model-e584ac/v1/completions","host":"e2e-shared-a-e584ac.apps.0882b177-5f5b-40a6-aa64-03f78bfa7495.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-21T21:45:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"004535dc-5c7a-42f2-a36a-2561b03cae76","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.11:39582","PortSpecifier":{"PortValue":39582}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.61:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784670309,"nanos":402802686},"http":{"id":"004535dc-5c7a-42f2-a36a-2561b03cae76","method":"POST","headers":{":authority":"e2e-shared-a-e584ac.apps.0882b177-5f5b-40a6-aa64-03f78bfa7495.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-e584ac/rate-test-model-e584ac/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T21:45:09Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"004535dc-5c7a-42f2-a36a-2561b03cae76","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-qxqq5go9mfcdL3vZ_rGB3oDfKYsjce4gBaCaACYIN26nNzvEhkFf9ajMTvt6"}
{"level":"debug","ts":"2026-07-21T21:45:09Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"004535dc-5c7a-42f2-a36a-2561b03cae76","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-e584ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-qxqq5go9mfcdL3vZ_rGB3oDfKYsjce4gBaCaACYIN26nNzvEhkFf9ajMTvt6\"}"}
{"level":"debug","ts":"2026-07-21T21:45:09Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"004535dc-5c7a-42f2-a36a-2561b03cae76","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e584ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"70dc88d4-9bd0-4a5d-8343-4668615ed807","keyName":"e2e-rate-a-bdf8ae","subscription":"e2e-rate-iso-a-bdf8ae","tenant":"e2e-shared-a-e584ac","userId":"70dc88d4-9bd0-4a5d-8343-4668615ed807","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-21T21:45:09Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"004535dc-5c7a-42f2-a36a-2561b03cae76","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-e584ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-e584ac/rate-test-model-e584ac\",\"requestedSubscription\":\"e2e-rate-iso-a-bdf8ae\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-21T21:45:09Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"004535dc-5c7a-42f2-a36a-2561b03cae76","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e584ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-e584ac","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-bdf8ae","namespace":"ai-tenant-e2e-shared-a-e584ac","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-e584ac/rate-test-model-e584ac"}}
{"level":"debug","ts":"2026-07-21T21:45:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"004535dc-5c7a-42f2-a36a-2561b03cae76","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T21:45:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"004535dc-5c7a-42f2-a36a-2561b03cae76","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T21:45:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"004535dc-5c7a-42f2-a36a-2561b03cae76","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T21:45:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"004535dc-5c7a-42f2-a36a-2561b03cae76","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T21:45:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"004535dc-5c7a-42f2-a36a-2561b03cae76","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e584ac/rate-test-model-e584ac\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-e584ac/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T21:45:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"004535dc-5c7a-42f2-a36a-2561b03cae76","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-21T21:45:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"004535dc-5c7a-42f2-a36a-2561b03cae76","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-21T21:45:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"004535dc-5c7a-42f2-a36a-2561b03cae76","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-bdf8ae"}
{"level":"debug","ts":"2026-07-21T21:45:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"004535dc-5c7a-42f2-a36a-2561b03cae76","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"70dc88d4-9bd0-4a5d-8343-4668615ed807","keyName":"e2e-rate-a-bdf8ae","selected_subscription":"e2e-rate-iso-a-bdf8ae","selected_subscription_key":"ai-tenant-e2e-shared-a-e584ac/e2e-rate-iso-a-bdf8ae@ai-tenant-e2e-shared-a-e584ac/rate-test-model-e584ac","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-e584ac","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-bdf8ae","namespace":"ai-tenant-e2e-shared-a-e584ac","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-e584ac/rate-test-model-e584ac"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-21T21:45:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"004535dc-5c7a-42f2-a36a-2561b03cae76","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-21T21:45:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"004535dc-5c7a-42f2-a36a-2561b03cae76","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-21T21:45:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2aac7af2-c85d-4115-b1dc-99d749a1cd20","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.11:39588","PortSpecifier":{"PortValue":39588}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.61:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2aac7af2-c85d-4115-b1dc-99d749a1cd20","method":"POST","path":"/ai-tenant-e2e-shared-a-e584ac/rate-test-model-e584ac/v1/completions","host":"e2e-shared-a-e584ac.apps.0882b177-5f5b-40a6-aa64-03f78bfa7495.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-21T21:45:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2aac7af2-c85d-4115-b1dc-99d749a1cd20","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.11:39588","PortSpecifier":{"PortValue":39588}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.61:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784670310,"nanos":464859793},"http":{"id":"2aac7af2-c85d-4115-b1dc-99d749a1cd20","method":"POST","headers":{":authority":"e2e-shared-a-e584ac.apps.0882b177-5f5b-40a6-aa64-03f78bfa7495.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-e584ac/rate-test-model-e584ac/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T21:45:10Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2aac7af2-c85d-4115-b1dc-99d749a1cd20","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-qxqq5go9mfcdL3vZ_rGB3oDfKYsjce4gBaCaACYIN26nNzvEhkFf9ajMTvt6"}
{"level":"debug","ts":"2026-07-21T21:45:10Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2aac7af2-c85d-4115-b1dc-99d749a1cd20","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-e584ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-qxqq5go9mfcdL3vZ_rGB3oDfKYsjce4gBaCaACYIN26nNzvEhkFf9ajMTvt6\"}"}
{"level":"debug","ts":"2026-07-21T21:45:10Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2aac7af2-c85d-4115-b1dc-99d749a1cd20","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e584ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"70dc88d4-9bd0-4a5d-8343-4668615ed807","keyName":"e2e-rate-a-bdf8ae","subscription":"e2e-rate-iso-a-bdf8ae","tenant":"e2e-shared-a-e584ac","userId":"70dc88d4-9bd0-4a5d-8343-4668615ed807","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-21T21:45:10Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2aac7af2-c85d-4115-b1dc-99d749a1cd20","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-e584ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-e584ac/rate-test-model-e584ac\",\"requestedSubscription\":\"e2e-rate-iso-a-bdf8ae\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-21T21:45:10Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2aac7af2-c85d-4115-b1dc-99d749a1cd20","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e584ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-e584ac","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-bdf8ae","namespace":"ai-tenant-e2e-shared-a-e584ac","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-e584ac/rate-test-model-e584ac"}}
{"level":"debug","ts":"2026-07-21T21:45:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2aac7af2-c85d-4115-b1dc-99d749a1cd20","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T21:45:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2aac7af2-c85d-4115-b1dc-99d749a1cd20","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T21:45:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2aac7af2-c85d-4115-b1dc-99d749a1cd20","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T21:45:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2aac7af2-c85d-4115-b1dc-99d749a1cd20","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e584ac/rate-test-model-e584ac\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-e584ac/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T21:45:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2aac7af2-c85d-4115-b1dc-99d749a1cd20","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T21:45:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2aac7af2-c85d-4115-b1dc-99d749a1cd20","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-21T21:45:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2aac7af2-c85d-4115-b1dc-99d749a1cd20","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-bdf8ae"}
{"level":"debug","ts":"2026-07-21T21:45:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2aac7af2-c85d-4115-b1dc-99d749a1cd20","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-21T21:45:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2aac7af2-c85d-4115-b1dc-99d749a1cd20","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"70dc88d4-9bd0-4a5d-8343-4668615ed807","keyName":"e2e-rate-a-bdf8ae","selected_subscription":"e2e-rate-iso-a-bdf8ae","selected_subscription_key":"ai-tenant-e2e-shared-a-e584ac/e2e-rate-iso-a-bdf8ae@ai-tenant-e2e-shared-a-e584ac/rate-test-model-e584ac","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-e584ac","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-bdf8ae","namespace":"ai-tenant-e2e-shared-a-e584ac","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-e584ac/rate-test-model-e584ac"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-21T21:45:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2aac7af2-c85d-4115-b1dc-99d749a1cd20","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-21T21:45:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2aac7af2-c85d-4115-b1dc-99d749a1cd20","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-21T21:45:11Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"99eb2d9e-7b9d-4041-b737-03f0f3107d52","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.11:35676","PortSpecifier":{"PortValue":35676}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.61:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"99eb2d9e-7b9d-4041-b737-03f0f3107d52","method":"POST","path":"/ai-tenant-e2e-shared-a-e584ac/rate-test-model-e584ac/v1/completions","host":"e2e-shared-a-e584ac.apps.0882b177-5f5b-40a6-aa64-03f78bfa7495.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-21T21:45:11Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"99eb2d9e-7b9d-4041-b737-03f0f3107d52","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.11:35676","PortSpecifier":{"PortValue":35676}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.61:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784670311,"nanos":507404618},"http":{"id":"99eb2d9e-7b9d-4041-b737-03f0f3107d52","method":"POST","headers":{":authority":"e2e-shared-a-e584ac.apps.0882b177-5f5b-40a6-aa64-03f78bfa7495.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-e584ac/rate-test-model-e584ac/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T21:45:11Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"99eb2d9e-7b9d-4041-b737-03f0f3107d52","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-qxqq5go9mfcdL3vZ_rGB3oDfKYsjce4gBaCaACYIN26nNzvEhkFf9ajMTvt6"}
{"level":"debug","ts":"2026-07-21T21:45:11Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"99eb2d9e-7b9d-4041-b737-03f0f3107d52","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-e584ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-qxqq5go9mfcdL3vZ_rGB3oDfKYsjce4gBaCaACYIN26nNzvEhkFf9ajMTvt6\"}"}
{"level":"debug","ts":"2026-07-21T21:45:11Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"99eb2d9e-7b9d-4041-b737-03f0f3107d52","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e584ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"70dc88d4-9bd0-4a5d-8343-4668615ed807","keyName":"e2e-rate-a-bdf8ae","subscription":"e2e-rate-iso-a-bdf8ae","tenant":"e2e-shared-a-e584ac","userId":"70dc88d4-9bd0-4a5d-8343-4668615ed807","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-21T21:45:11Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"99eb2d9e-7b9d-4041-b737-03f0f3107d52","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-e584ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-e584ac/rate-test-model-e584ac\",\"requestedSubscription\":\"e2e-rate-iso-a-bdf8ae\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-21T21:45:11Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"99eb2d9e-7b9d-4041-b737-03f0f3107d52","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e584ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-e584ac","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-bdf8ae","namespace":"ai-tenant-e2e-shared-a-e584ac","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-e584ac/rate-test-model-e584ac"}}
{"level":"debug","ts":"2026-07-21T21:45:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"99eb2d9e-7b9d-4041-b737-03f0f3107d52","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T21:45:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"99eb2d9e-7b9d-4041-b737-03f0f3107d52","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T21:45:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"99eb2d9e-7b9d-4041-b737-03f0f3107d52","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T21:45:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"99eb2d9e-7b9d-4041-b737-03f0f3107d52","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e584ac/rate-test-model-e584ac\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-e584ac/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T21:45:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"99eb2d9e-7b9d-4041-b737-03f0f3107d52","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T21:45:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"99eb2d9e-7b9d-4041-b737-03f0f3107d52","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-21T21:45:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"99eb2d9e-7b9d-4041-b737-03f0f3107d52","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-bdf8ae"}
{"level":"debug","ts":"2026-07-21T21:45:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"99eb2d9e-7b9d-4041-b737-03f0f3107d52","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-21T21:45:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"99eb2d9e-7b9d-4041-b737-03f0f3107d52","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"70dc88d4-9bd0-4a5d-8343-4668615ed807","keyName":"e2e-rate-a-bdf8ae","selected_subscription":"e2e-rate-iso-a-bdf8ae","selected_subscription_key":"ai-tenant-e2e-shared-a-e584ac/e2e-rate-iso-a-bdf8ae@ai-tenant-e2e-shared-a-e584ac/rate-test-model-e584ac","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-e584ac","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-bdf8ae","namespace":"ai-tenant-e2e-shared-a-e584ac","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-e584ac/rate-test-model-e584ac"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-21T21:45:11Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"99eb2d9e-7b9d-4041-b737-03f0f3107d52","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-21T21:45:11Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"99eb2d9e-7b9d-4041-b737-03f0f3107d52","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-21T21:45:12Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"70731b11-1687-4ed3-a633-19fecc61a805","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.11:35690","PortSpecifier":{"PortValue":35690}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.61:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"70731b11-1687-4ed3-a633-19fecc61a805","method":"POST","path":"/ai-tenant-e2e-shared-a-e584ac/rate-test-model-e584ac/v1/completions","host":"e2e-shared-a-e584ac.apps.0882b177-5f5b-40a6-aa64-03f78bfa7495.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-21T21:45:12Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"70731b11-1687-4ed3-a633-19fecc61a805","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.11:35690","PortSpecifier":{"PortValue":35690}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.61:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784670312,"nanos":546332670},"http":{"id":"70731b11-1687-4ed3-a633-19fecc61a805","method":"POST","headers":{":authority":"e2e-shared-a-e584ac.apps.0882b177-5f5b-40a6-aa64-03f78bfa7495.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-e584ac/rate-test-model-e584ac/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T21:45:12Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"70731b11-1687-4ed3-a633-19fecc61a805","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-qxqq5go9mfcdL3vZ_rGB3oDfKYsjce4gBaCaACYIN26nNzvEhkFf9ajMTvt6"}
{"level":"debug","ts":"2026-07-21T21:45:12Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"70731b11-1687-4ed3-a633-19fecc61a805","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-e584ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-qxqq5go9mfcdL3vZ_rGB3oDfKYsjce4gBaCaACYIN26nNzvEhkFf9ajMTvt6\"}"}
{"level":"debug","ts":"2026-07-21T21:45:12Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"70731b11-1687-4ed3-a633-19fecc61a805","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e584ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"70dc88d4-9bd0-4a5d-8343-4668615ed807","keyName":"e2e-rate-a-bdf8ae","subscription":"e2e-rate-iso-a-bdf8ae","tenant":"e2e-shared-a-e584ac","userId":"70dc88d4-9bd0-4a5d-8343-4668615ed807","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-21T21:45:12Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"70731b11-1687-4ed3-a633-19fecc61a805","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-e584ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-e584ac/rate-test-model-e584ac\",\"requestedSubscription\":\"e2e-rate-iso-a-bdf8ae\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-21T21:45:12Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"70731b11-1687-4ed3-a633-19fecc61a805","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e584ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-e584ac","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-bdf8ae","namespace":"ai-tenant-e2e-shared-a-e584ac","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-e584ac/rate-test-model-e584ac"}}
{"level":"debug","ts":"2026-07-21T21:45:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"70731b11-1687-4ed3-a633-19fecc61a805","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T21:45:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"70731b11-1687-4ed3-a633-19fecc61a805","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T21:45:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"70731b11-1687-4ed3-a633-19fecc61a805","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T21:45:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"70731b11-1687-4ed3-a633-19fecc61a805","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T21:45:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"70731b11-1687-4ed3-a633-19fecc61a805","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e584ac/rate-test-model-e584ac\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-e584ac/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T21:45:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"70731b11-1687-4ed3-a633-19fecc61a805","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-21T21:45:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"70731b11-1687-4ed3-a633-19fecc61a805","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-bdf8ae"}
{"level":"debug","ts":"2026-07-21T21:45:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"70731b11-1687-4ed3-a633-19fecc61a805","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-21T21:45:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"70731b11-1687-4ed3-a633-19fecc61a805","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"70dc88d4-9bd0-4a5d-8343-4668615ed807","keyName":"e2e-rate-a-bdf8ae","selected_subscription":"e2e-rate-iso-a-bdf8ae","selected_subscription_key":"ai-tenant-e2e-shared-a-e584ac/e2e-rate-iso-a-bdf8ae@ai-tenant-e2e-shared-a-e584ac/rate-test-model-e584ac","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-e584ac","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-bdf8ae","namespace":"ai-tenant-e2e-shared-a-e584ac","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-e584ac/rate-test-model-e584ac"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-21T21:45:12Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"70731b11-1687-4ed3-a633-19fecc61a805","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-21T21:45:12Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"70731b11-1687-4ed3-a633-19fecc61a805","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-21T21:45:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c023128c-77dc-44eb-836f-164c68af67f4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.11:35706","PortSpecifier":{"PortValue":35706}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.61:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c023128c-77dc-44eb-836f-164c68af67f4","method":"POST","path":"/ai-tenant-e2e-shared-a-e584ac/rate-test-model-e584ac/v1/completions","host":"e2e-shared-a-e584ac.apps.0882b177-5f5b-40a6-aa64-03f78bfa7495.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-21T21:45:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c023128c-77dc-44eb-836f-164c68af67f4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.11:35706","PortSpecifier":{"PortValue":35706}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.61:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784670313,"nanos":584436383},"http":{"id":"c023128c-77dc-44eb-836f-164c68af67f4","method":"POST","headers":{":authority":"e2e-shared-a-e584ac.apps.0882b177-5f5b-40a6-aa64-03f78bfa7495.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-e584ac/rate-test-model-e584ac/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T21:45:13Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"c023128c-77dc-44eb-836f-164c68af67f4","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-qxqq5go9mfcdL3vZ_rGB3oDfKYsjce4gBaCaACYIN26nNzvEhkFf9ajMTvt6"}
{"level":"debug","ts":"2026-07-21T21:45:13Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c023128c-77dc-44eb-836f-164c68af67f4","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-e584ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-qxqq5go9mfcdL3vZ_rGB3oDfKYsjce4gBaCaACYIN26nNzvEhkFf9ajMTvt6\"}"}
{"level":"debug","ts":"2026-07-21T21:45:13Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c023128c-77dc-44eb-836f-164c68af67f4","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e584ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"70dc88d4-9bd0-4a5d-8343-4668615ed807","keyName":"e2e-rate-a-bdf8ae","subscription":"e2e-rate-iso-a-bdf8ae","tenant":"e2e-shared-a-e584ac","userId":"70dc88d4-9bd0-4a5d-8343-4668615ed807","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-21T21:45:13Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c023128c-77dc-44eb-836f-164c68af67f4","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-e584ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-e584ac/rate-test-model-e584ac\",\"requestedSubscription\":\"e2e-rate-iso-a-bdf8ae\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-21T21:45:13Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c023128c-77dc-44eb-836f-164c68af67f4","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e584ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-e584ac","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-bdf8ae","namespace":"ai-tenant-e2e-shared-a-e584ac","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-e584ac/rate-test-model-e584ac"}}
{"level":"debug","ts":"2026-07-21T21:45:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"c023128c-77dc-44eb-836f-164c68af67f4","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T21:45:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c023128c-77dc-44eb-836f-164c68af67f4","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T21:45:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c023128c-77dc-44eb-836f-164c68af67f4","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T21:45:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c023128c-77dc-44eb-836f-164c68af67f4","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T21:45:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c023128c-77dc-44eb-836f-164c68af67f4","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e584ac/rate-test-model-e584ac\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-e584ac/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T21:45:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c023128c-77dc-44eb-836f-164c68af67f4","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-21T21:45:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c023128c-77dc-44eb-836f-164c68af67f4","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-bdf8ae"}
{"level":"debug","ts":"2026-07-21T21:45:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c023128c-77dc-44eb-836f-164c68af67f4","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-21T21:45:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c023128c-77dc-44eb-836f-164c68af67f4","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"70dc88d4-9bd0-4a5d-8343-4668615ed807","keyName":"e2e-rate-a-bdf8ae","selected_subscription":"e2e-rate-iso-a-bdf8ae","selected_subscription_key":"ai-tenant-e2e-shared-a-e584ac/e2e-rate-iso-a-bdf8ae@ai-tenant-e2e-shared-a-e584ac/rate-test-model-e584ac","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-e584ac","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-bdf8ae","namespace":"ai-tenant-e2e-shared-a-e584ac","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-e584ac/rate-test-model-e584ac"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-21T21:45:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c023128c-77dc-44eb-836f-164c68af67f4","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-21T21:45:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c023128c-77dc-44eb-836f-164c68af67f4","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-21T21:45:14Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d091a9d7-a7ab-4667-9bfe-9199866bcd1a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.11:35722","PortSpecifier":{"PortValue":35722}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.61:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d091a9d7-a7ab-4667-9bfe-9199866bcd1a","method":"POST","path":"/ai-tenant-e2e-shared-a-e584ac/rate-test-model-e584ac/v1/completions","host":"e2e-shared-a-e584ac.apps.0882b177-5f5b-40a6-aa64-03f78bfa7495.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-21T21:45:14Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d091a9d7-a7ab-4667-9bfe-9199866bcd1a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.11:35722","PortSpecifier":{"PortValue":35722}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.61:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784670314,"nanos":625653270},"http":{"id":"d091a9d7-a7ab-4667-9bfe-9199866bcd1a","method":"POST","headers":{":authority":"e2e-shared-a-e584ac.apps.0882b177-5f5b-40a6-aa64-03f78bfa7495.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-e584ac/rate-test-model-e584ac/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T21:45:14Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d091a9d7-a7ab-4667-9bfe-9199866bcd1a","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-qxqq5go9mfcdL3vZ_rGB3oDfKYsjce4gBaCaACYIN26nNzvEhkFf9ajMTvt6"}
{"level":"debug","ts":"2026-07-21T21:45:14Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d091a9d7-a7ab-4667-9bfe-9199866bcd1a","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-e584ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-qxqq5go9mfcdL3vZ_rGB3oDfKYsjce4gBaCaACYIN26nNzvEhkFf9ajMTvt6\"}"}
{"level":"debug","ts":"2026-07-21T21:45:14Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d091a9d7-a7ab-4667-9bfe-9199866bcd1a","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e584ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"70dc88d4-9bd0-4a5d-8343-4668615ed807","keyName":"e2e-rate-a-bdf8ae","subscription":"e2e-rate-iso-a-bdf8ae","tenant":"e2e-shared-a-e584ac","userId":"70dc88d4-9bd0-4a5d-8343-4668615ed807","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-21T21:45:14Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d091a9d7-a7ab-4667-9bfe-9199866bcd1a","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-e584ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-e584ac/rate-test-model-e584ac\",\"requestedSubscription\":\"e2e-rate-iso-a-bdf8ae\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-21T21:45:14Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d091a9d7-a7ab-4667-9bfe-9199866bcd1a","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e584ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-e584ac","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-bdf8ae","namespace":"ai-tenant-e2e-shared-a-e584ac","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-e584ac/rate-test-model-e584ac"}}
{"level":"debug","ts":"2026-07-21T21:45:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d091a9d7-a7ab-4667-9bfe-9199866bcd1a","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T21:45:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d091a9d7-a7ab-4667-9bfe-9199866bcd1a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T21:45:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d091a9d7-a7ab-4667-9bfe-9199866bcd1a","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T21:45:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d091a9d7-a7ab-4667-9bfe-9199866bcd1a","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e584ac/rate-test-model-e584ac\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-e584ac/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T21:45:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d091a9d7-a7ab-4667-9bfe-9199866bcd1a","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T21:45:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d091a9d7-a7ab-4667-9bfe-9199866bcd1a","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-bdf8ae"}
{"level":"debug","ts":"2026-07-21T21:45:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d091a9d7-a7ab-4667-9bfe-9199866bcd1a","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-21T21:45:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d091a9d7-a7ab-4667-9bfe-9199866bcd1a","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-21T21:45:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d091a9d7-a7ab-4667-9bfe-9199866bcd1a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"70dc88d4-9bd0-4a5d-8343-4668615ed807","keyName":"e2e-rate-a-bdf8ae","selected_subscription":"e2e-rate-iso-a-bdf8ae","selected_subscription_key":"ai-tenant-e2e-shared-a-e584ac/e2e-rate-iso-a-bdf8ae@ai-tenant-e2e-shared-a-e584ac/rate-test-model-e584ac","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-e584ac","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-bdf8ae","namespace":"ai-tenant-e2e-shared-a-e584ac","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-e584ac/rate-test-model-e584ac"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-21T21:45:14Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d091a9d7-a7ab-4667-9bfe-9199866bcd1a","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-21T21:45:14Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d091a9d7-a7ab-4667-9bfe-9199866bcd1a","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-21T21:45:15Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"389cca42-15a5-4720-8b68-0f97f93a57ea","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.11:35728","PortSpecifier":{"PortValue":35728}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.61:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"389cca42-15a5-4720-8b68-0f97f93a57ea","method":"POST","path":"/ai-tenant-e2e-shared-a-e584ac/rate-test-model-e584ac/v1/completions","host":"e2e-shared-a-e584ac.apps.0882b177-5f5b-40a6-aa64-03f78bfa7495.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-21T21:45:15Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"389cca42-15a5-4720-8b68-0f97f93a57ea","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.11:35728","PortSpecifier":{"PortValue":35728}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.61:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784670315,"nanos":666129772},"http":{"id":"389cca42-15a5-4720-8b68-0f97f93a57ea","method":"POST","headers":{":authority":"e2e-shared-a-e584ac.apps.0882b177-5f5b-40a6-aa64-03f78bfa7495.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-e584ac/rate-test-model-e584ac/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T21:45:15Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"389cca42-15a5-4720-8b68-0f97f93a57ea","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-qxqq5go9mfcdL3vZ_rGB3oDfKYsjce4gBaCaACYIN26nNzvEhkFf9ajMTvt6"}
{"level":"debug","ts":"2026-07-21T21:45:15Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"389cca42-15a5-4720-8b68-0f97f93a57ea","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-e584ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-qxqq5go9mfcdL3vZ_rGB3oDfKYsjce4gBaCaACYIN26nNzvEhkFf9ajMTvt6\"}"}
{"level":"debug","ts":"2026-07-21T21:45:15Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"389cca42-15a5-4720-8b68-0f97f93a57ea","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e584ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"70dc88d4-9bd0-4a5d-8343-4668615ed807","keyName":"e2e-rate-a-bdf8ae","subscription":"e2e-rate-iso-a-bdf8ae","tenant":"e2e-shared-a-e584ac","userId":"70dc88d4-9bd0-4a5d-8343-4668615ed807","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-21T21:45:15Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"389cca42-15a5-4720-8b68-0f97f93a57ea","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-e584ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-e584ac/rate-test-model-e584ac\",\"requestedSubscription\":\"e2e-rate-iso-a-bdf8ae\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-21T21:45:15Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"389cca42-15a5-4720-8b68-0f97f93a57ea","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e584ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-e584ac","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-bdf8ae","namespace":"ai-tenant-e2e-shared-a-e584ac","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-e584ac/rate-test-model-e584ac"}}
{"level":"debug","ts":"2026-07-21T21:45:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"389cca42-15a5-4720-8b68-0f97f93a57ea","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T21:45:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"389cca42-15a5-4720-8b68-0f97f93a57ea","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T21:45:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"389cca42-15a5-4720-8b68-0f97f93a57ea","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T21:45:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"389cca42-15a5-4720-8b68-0f97f93a57ea","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e584ac/rate-test-model-e584ac\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-e584ac/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T21:45:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"389cca42-15a5-4720-8b68-0f97f93a57ea","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T21:45:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"389cca42-15a5-4720-8b68-0f97f93a57ea","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-21T21:45:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"389cca42-15a5-4720-8b68-0f97f93a57ea","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-bdf8ae"}
{"level":"debug","ts":"2026-07-21T21:45:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"389cca42-15a5-4720-8b68-0f97f93a57ea","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-21T21:45:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"389cca42-15a5-4720-8b68-0f97f93a57ea","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"70dc88d4-9bd0-4a5d-8343-4668615ed807","keyName":"e2e-rate-a-bdf8ae","selected_subscription":"e2e-rate-iso-a-bdf8ae","selected_subscription_key":"ai-tenant-e2e-shared-a-e584ac/e2e-rate-iso-a-bdf8ae@ai-tenant-e2e-shared-a-e584ac/rate-test-model-e584ac","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-e584ac","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-bdf8ae","namespace":"ai-tenant-e2e-shared-a-e584ac","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-e584ac/rate-test-model-e584ac"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-21T21:45:15Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"389cca42-15a5-4720-8b68-0f97f93a57ea","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-21T21:45:15Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"389cca42-15a5-4720-8b68-0f97f93a57ea","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-21T21:45:16Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c43a8136-6164-4e11-86ec-81a1fd6db6c0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.11:35742","PortSpecifier":{"PortValue":35742}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.61:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c43a8136-6164-4e11-86ec-81a1fd6db6c0","method":"POST","path":"/ai-tenant-e2e-shared-a-e584ac/rate-test-model-e584ac/v1/completions","host":"e2e-shared-a-e584ac.apps.0882b177-5f5b-40a6-aa64-03f78bfa7495.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-21T21:45:16Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c43a8136-6164-4e11-86ec-81a1fd6db6c0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.11:35742","PortSpecifier":{"PortValue":35742}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.61:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784670316,"nanos":735873284},"http":{"id":"c43a8136-6164-4e11-86ec-81a1fd6db6c0","method":"POST","headers":{":authority":"e2e-shared-a-e584ac.apps.0882b177-5f5b-40a6-aa64-03f78bfa7495.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-e584ac/rate-test-model-e584ac/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T21:45:16Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"c43a8136-6164-4e11-86ec-81a1fd6db6c0","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-qxqq5go9mfcdL3vZ_rGB3oDfKYsjce4gBaCaACYIN26nNzvEhkFf9ajMTvt6"}
{"level":"debug","ts":"2026-07-21T21:45:16Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c43a8136-6164-4e11-86ec-81a1fd6db6c0","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-e584ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-qxqq5go9mfcdL3vZ_rGB3oDfKYsjce4gBaCaACYIN26nNzvEhkFf9ajMTvt6\"}"}
{"level":"debug","ts":"2026-07-21T21:45:16Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c43a8136-6164-4e11-86ec-81a1fd6db6c0","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e584ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"70dc88d4-9bd0-4a5d-8343-4668615ed807","keyName":"e2e-rate-a-bdf8ae","subscription":"e2e-rate-iso-a-bdf8ae","tenant":"e2e-shared-a-e584ac","userId":"70dc88d4-9bd0-4a5d-8343-4668615ed807","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-21T21:45:16Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c43a8136-6164-4e11-86ec-81a1fd6db6c0","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-e584ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-e584ac/rate-test-model-e584ac\",\"requestedSubscription\":\"e2e-rate-iso-a-bdf8ae\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-21T21:45:16Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c43a8136-6164-4e11-86ec-81a1fd6db6c0","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e584ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-e584ac","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-bdf8ae","namespace":"ai-tenant-e2e-shared-a-e584ac","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-e584ac/rate-test-model-e584ac"}}
{"level":"debug","ts":"2026-07-21T21:45:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"c43a8136-6164-4e11-86ec-81a1fd6db6c0","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T21:45:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c43a8136-6164-4e11-86ec-81a1fd6db6c0","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T21:45:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c43a8136-6164-4e11-86ec-81a1fd6db6c0","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T21:45:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c43a8136-6164-4e11-86ec-81a1fd6db6c0","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T21:45:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c43a8136-6164-4e11-86ec-81a1fd6db6c0","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e584ac/rate-test-model-e584ac\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-e584ac/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T21:45:16Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c43a8136-6164-4e11-86ec-81a1fd6db6c0","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-bdf8ae"}
{"level":"debug","ts":"2026-07-21T21:45:16Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c43a8136-6164-4e11-86ec-81a1fd6db6c0","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-21T21:45:16Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c43a8136-6164-4e11-86ec-81a1fd6db6c0","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-21T21:45:16Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c43a8136-6164-4e11-86ec-81a1fd6db6c0","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"70dc88d4-9bd0-4a5d-8343-4668615ed807","keyName":"e2e-rate-a-bdf8ae","selected_subscription":"e2e-rate-iso-a-bdf8ae","selected_subscription_key":"ai-tenant-e2e-shared-a-e584ac/e2e-rate-iso-a-bdf8ae@ai-tenant-e2e-shared-a-e584ac/rate-test-model-e584ac","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-e584ac","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-bdf8ae","namespace":"ai-tenant-e2e-shared-a-e584ac","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-e584ac/rate-test-model-e584ac"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-21T21:45:16Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c43a8136-6164-4e11-86ec-81a1fd6db6c0","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-21T21:45:16Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c43a8136-6164-4e11-86ec-81a1fd6db6c0","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-21T21:45:25Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b7192ca8-535a-4971-95f9-fdf80040c5e9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.11:45342","PortSpecifier":{"PortValue":45342}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.61:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b7192ca8-535a-4971-95f9-fdf80040c5e9","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-e584ac.apps.0882b177-5f5b-40a6-aa64-03f78bfa7495.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-21T21:45:25Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b7192ca8-535a-4971-95f9-fdf80040c5e9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.11:45342","PortSpecifier":{"PortValue":45342}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.61:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784670325,"nanos":872726716},"http":{"id":"b7192ca8-535a-4971-95f9-fdf80040c5e9","method":"POST","headers":{":authority":"e2e-shared-a-e584ac.apps.0882b177-5f5b-40a6-aa64-03f78bfa7495.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T21:45:25Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"b7192ca8-535a-4971-95f9-fdf80040c5e9","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-21T21:45:25Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b7192ca8-535a-4971-95f9-fdf80040c5e9","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"53006d43-ceb2-495a-b14f-38750ec9f735","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=8bf6eb0b-9752-4b55-aa51-fd32da69924a"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/03f78bfa7495"]}}
{"level":"debug","ts":"2026-07-21T21:45:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b7192ca8-535a-4971-95f9-fdf80040c5e9","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/03f78bfa7495"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=8bf6eb0b-9752-4b55-aa51-fd32da69924a"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"53006d43-ceb2-495a-b14f-38750ec9f735","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"3a07b1d8ecc43bd9cfaee018e614c34380109af366b8f3ef7948d4bd72639e1c"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.61:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-e584ac.apps.0882b177-5f5b-40a6-aa64-03f78bfa7495.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T21:45:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b7192ca8-535a-4971-95f9-fdf80040c5e9","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T21:45:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b7192ca8-535a-4971-95f9-fdf80040c5e9","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T21:45:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b7192ca8-535a-4971-95f9-fdf80040c5e9","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e584ac/rate-test-model-e584ac\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-e584ac/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T21:45:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"b7192ca8-535a-4971-95f9-fdf80040c5e9","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-21T21:45:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b7192ca8-535a-4971-95f9-fdf80040c5e9","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-21T21:45:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b7192ca8-535a-4971-95f9-fdf80040c5e9","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-21T21:45:25Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b7192ca8-535a-4971-95f9-fdf80040c5e9","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-21T21:45:25Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b7192ca8-535a-4971-95f9-fdf80040c5e9","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-21T21:45:25Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"065dcc2c-16e1-4ce6-b20a-1f9936369ec2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.11:55414","PortSpecifier":{"PortValue":55414}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.62:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"065dcc2c-16e1-4ce6-b20a-1f9936369ec2","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-24ec74.apps.0882b177-5f5b-40a6-aa64-03f78bfa7495.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-21T21:45:25Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"065dcc2c-16e1-4ce6-b20a-1f9936369ec2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.11:55414","PortSpecifier":{"PortValue":55414}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.62:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784670325,"nanos":939441566},"http":{"id":"065dcc2c-16e1-4ce6-b20a-1f9936369ec2","method":"POST","headers":{":authority":"e2e-shared-b-24ec74.apps.0882b177-5f5b-40a6-aa64-03f78bfa7495.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T21:45:25Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"065dcc2c-16e1-4ce6-b20a-1f9936369ec2","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-21T21:45:25Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"065dcc2c-16e1-4ce6-b20a-1f9936369ec2","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"53006d43-ceb2-495a-b14f-38750ec9f735","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=8bf6eb0b-9752-4b55-aa51-fd32da69924a"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/03f78bfa7495"]}}
{"level":"debug","ts":"2026-07-21T21:45:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"065dcc2c-16e1-4ce6-b20a-1f9936369ec2","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/03f78bfa7495"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=8bf6eb0b-9752-4b55-aa51-fd32da69924a"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"53006d43-ceb2-495a-b14f-38750ec9f735","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"15703863ca9027f27616c402c60e788b5ab1f3b7e6bf16cc9e69a95e65ccdf59"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.62:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-24ec74.apps.0882b177-5f5b-40a6-aa64-03f78bfa7495.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T21:45:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"065dcc2c-16e1-4ce6-b20a-1f9936369ec2","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T21:45:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"065dcc2c-16e1-4ce6-b20a-1f9936369ec2","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T21:45:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"065dcc2c-16e1-4ce6-b20a-1f9936369ec2","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-24ec74/rate-test-model-24ec74\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-24ec74/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T21:45:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"065dcc2c-16e1-4ce6-b20a-1f9936369ec2","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-21T21:45:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"065dcc2c-16e1-4ce6-b20a-1f9936369ec2","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-21T21:45:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"065dcc2c-16e1-4ce6-b20a-1f9936369ec2","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-21T21:45:25Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"065dcc2c-16e1-4ce6-b20a-1f9936369ec2","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-21T21:45:25Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"065dcc2c-16e1-4ce6-b20a-1f9936369ec2","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-21T21:45:25Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"341abb9f-c250-44a9-88be-01442f7ea5c4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.11:45354","PortSpecifier":{"PortValue":45354}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.61:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"341abb9f-c250-44a9-88be-01442f7ea5c4","method":"POST","path":"/ai-tenant-e2e-shared-a-e584ac/rate-test-model-e584ac/v1/completions","host":"e2e-shared-a-e584ac.apps.0882b177-5f5b-40a6-aa64-03f78bfa7495.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-21T21:45:25Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"341abb9f-c250-44a9-88be-01442f7ea5c4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.11:45354","PortSpecifier":{"PortValue":45354}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.61:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784670325,"nanos":980118844},"http":{"id":"341abb9f-c250-44a9-88be-01442f7ea5c4","method":"POST","headers":{":authority":"e2e-shared-a-e584ac.apps.0882b177-5f5b-40a6-aa64-03f78bfa7495.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-e584ac/rate-test-model-e584ac/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T21:45:25Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"341abb9f-c250-44a9-88be-01442f7ea5c4","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-JYsgxktb7c7vp0lg_DOjhyVAbB09TnbYhaCiWkdQI2cABd91syLSJSKewiUX"}
{"level":"debug","ts":"2026-07-21T21:45:25Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"341abb9f-c250-44a9-88be-01442f7ea5c4","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-e584ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-JYsgxktb7c7vp0lg_DOjhyVAbB09TnbYhaCiWkdQI2cABd91syLSJSKewiUX\"}"}
{"level":"debug","ts":"2026-07-21T21:45:25Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"341abb9f-c250-44a9-88be-01442f7ea5c4","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e584ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"ae2d348b-bd47-41ba-a3f6-e248afd217a7","keyName":"e2e-rate-a-5a8e1f","subscription":"e2e-rate-iso-a-5a8e1f","tenant":"e2e-shared-a-e584ac","userId":"ae2d348b-bd47-41ba-a3f6-e248afd217a7","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-21T21:45:25Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"341abb9f-c250-44a9-88be-01442f7ea5c4","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-e584ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-e584ac/rate-test-model-e584ac\",\"requestedSubscription\":\"e2e-rate-iso-a-5a8e1f\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-21T21:45:25Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"341abb9f-c250-44a9-88be-01442f7ea5c4","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e584ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-e584ac","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-5a8e1f","namespace":"ai-tenant-e2e-shared-a-e584ac","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-e584ac/rate-test-model-e584ac"}}
{"level":"debug","ts":"2026-07-21T21:45:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"341abb9f-c250-44a9-88be-01442f7ea5c4","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T21:45:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"341abb9f-c250-44a9-88be-01442f7ea5c4","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T21:45:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"341abb9f-c250-44a9-88be-01442f7ea5c4","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T21:45:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"341abb9f-c250-44a9-88be-01442f7ea5c4","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e584ac/rate-test-model-e584ac\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-e584ac/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T21:45:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"341abb9f-c250-44a9-88be-01442f7ea5c4","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T21:45:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"341abb9f-c250-44a9-88be-01442f7ea5c4","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-5a8e1f"}
{"level":"debug","ts":"2026-07-21T21:45:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"341abb9f-c250-44a9-88be-01442f7ea5c4","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-21T21:45:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"341abb9f-c250-44a9-88be-01442f7ea5c4","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-21T21:45:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"341abb9f-c250-44a9-88be-01442f7ea5c4","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"ae2d348b-bd47-41ba-a3f6-e248afd217a7","keyName":"e2e-rate-a-5a8e1f","selected_subscription":"e2e-rate-iso-a-5a8e1f","selected_subscription_key":"ai-tenant-e2e-shared-a-e584ac/e2e-rate-iso-a-5a8e1f@ai-tenant-e2e-shared-a-e584ac/rate-test-model-e584ac","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-e584ac","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-5a8e1f","namespace":"ai-tenant-e2e-shared-a-e584ac","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-e584ac/rate-test-model-e584ac"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-21T21:45:25Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"341abb9f-c250-44a9-88be-01442f7ea5c4","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-21T21:45:25Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"341abb9f-c250-44a9-88be-01442f7ea5c4","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-21T21:45:27Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"80ddfb3a-42c2-4a9b-a1e6-6b9ca9f263c9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.11:45366","PortSpecifier":{"PortValue":45366}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.61:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"80ddfb3a-42c2-4a9b-a1e6-6b9ca9f263c9","method":"POST","path":"/ai-tenant-e2e-shared-a-e584ac/rate-test-model-e584ac/v1/completions","host":"e2e-shared-a-e584ac.apps.0882b177-5f5b-40a6-aa64-03f78bfa7495.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-21T21:45:27Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"80ddfb3a-42c2-4a9b-a1e6-6b9ca9f263c9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.11:45366","PortSpecifier":{"PortValue":45366}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.61:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784670327,"nanos":21974982},"http":{"id":"80ddfb3a-42c2-4a9b-a1e6-6b9ca9f263c9","method":"POST","headers":{":authority":"e2e-shared-a-e584ac.apps.0882b177-5f5b-40a6-aa64-03f78bfa7495.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-e584ac/rate-test-model-e584ac/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T21:45:27Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"80ddfb3a-42c2-4a9b-a1e6-6b9ca9f263c9","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-JYsgxktb7c7vp0lg_DOjhyVAbB09TnbYhaCiWkdQI2cABd91syLSJSKewiUX"}
{"level":"debug","ts":"2026-07-21T21:45:27Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"80ddfb3a-42c2-4a9b-a1e6-6b9ca9f263c9","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-e584ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-JYsgxktb7c7vp0lg_DOjhyVAbB09TnbYhaCiWkdQI2cABd91syLSJSKewiUX\"}"}
{"level":"debug","ts":"2026-07-21T21:45:27Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"80ddfb3a-42c2-4a9b-a1e6-6b9ca9f263c9","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e584ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"ae2d348b-bd47-41ba-a3f6-e248afd217a7","keyName":"e2e-rate-a-5a8e1f","subscription":"e2e-rate-iso-a-5a8e1f","tenant":"e2e-shared-a-e584ac","userId":"ae2d348b-bd47-41ba-a3f6-e248afd217a7","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-21T21:45:27Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"80ddfb3a-42c2-4a9b-a1e6-6b9ca9f263c9","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-e584ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-e584ac/rate-test-model-e584ac\",\"requestedSubscription\":\"e2e-rate-iso-a-5a8e1f\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-21T21:45:27Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"80ddfb3a-42c2-4a9b-a1e6-6b9ca9f263c9","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e584ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-e584ac","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-5a8e1f","namespace":"ai-tenant-e2e-shared-a-e584ac","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-e584ac/rate-test-model-e584ac"}}
{"level":"debug","ts":"2026-07-21T21:45:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"80ddfb3a-42c2-4a9b-a1e6-6b9ca9f263c9","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T21:45:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"80ddfb3a-42c2-4a9b-a1e6-6b9ca9f263c9","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T21:45:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"80ddfb3a-42c2-4a9b-a1e6-6b9ca9f263c9","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T21:45:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"80ddfb3a-42c2-4a9b-a1e6-6b9ca9f263c9","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e584ac/rate-test-model-e584ac\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-e584ac/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T21:45:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"80ddfb3a-42c2-4a9b-a1e6-6b9ca9f263c9","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T21:45:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"80ddfb3a-42c2-4a9b-a1e6-6b9ca9f263c9","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-5a8e1f"}
{"level":"debug","ts":"2026-07-21T21:45:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"80ddfb3a-42c2-4a9b-a1e6-6b9ca9f263c9","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-21T21:45:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"80ddfb3a-42c2-4a9b-a1e6-6b9ca9f263c9","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-21T21:45:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"80ddfb3a-42c2-4a9b-a1e6-6b9ca9f263c9","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"ae2d348b-bd47-41ba-a3f6-e248afd217a7","keyName":"e2e-rate-a-5a8e1f","selected_subscription":"e2e-rate-iso-a-5a8e1f","selected_subscription_key":"ai-tenant-e2e-shared-a-e584ac/e2e-rate-iso-a-5a8e1f@ai-tenant-e2e-shared-a-e584ac/rate-test-model-e584ac","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-e584ac","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-5a8e1f","namespace":"ai-tenant-e2e-shared-a-e584ac","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-e584ac/rate-test-model-e584ac"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-21T21:45:27Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"80ddfb3a-42c2-4a9b-a1e6-6b9ca9f263c9","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-21T21:45:27Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"80ddfb3a-42c2-4a9b-a1e6-6b9ca9f263c9","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-21T21:45:28Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"25430915-7357-44e6-abfc-f882cd2b5d59","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.11:45382","PortSpecifier":{"PortValue":45382}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.61:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"25430915-7357-44e6-abfc-f882cd2b5d59","method":"POST","path":"/ai-tenant-e2e-shared-a-e584ac/rate-test-model-e584ac/v1/completions","host":"e2e-shared-a-e584ac.apps.0882b177-5f5b-40a6-aa64-03f78bfa7495.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-21T21:45:28Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"25430915-7357-44e6-abfc-f882cd2b5d59","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.11:45382","PortSpecifier":{"PortValue":45382}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.61:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784670328,"nanos":61884530},"http":{"id":"25430915-7357-44e6-abfc-f882cd2b5d59","method":"POST","headers":{":authority":"e2e-shared-a-e584ac.apps.0882b177-5f5b-40a6-aa64-03f78bfa7495.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-e584ac/rate-test-model-e584ac/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T21:45:28Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"25430915-7357-44e6-abfc-f882cd2b5d59","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-JYsgxktb7c7vp0lg_DOjhyVAbB09TnbYhaCiWkdQI2cABd91syLSJSKewiUX"}
{"level":"debug","ts":"2026-07-21T21:45:28Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"25430915-7357-44e6-abfc-f882cd2b5d59","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-e584ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-JYsgxktb7c7vp0lg_DOjhyVAbB09TnbYhaCiWkdQI2cABd91syLSJSKewiUX\"}"}
{"level":"debug","ts":"2026-07-21T21:45:28Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"25430915-7357-44e6-abfc-f882cd2b5d59","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e584ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"ae2d348b-bd47-41ba-a3f6-e248afd217a7","keyName":"e2e-rate-a-5a8e1f","subscription":"e2e-rate-iso-a-5a8e1f","tenant":"e2e-shared-a-e584ac","userId":"ae2d348b-bd47-41ba-a3f6-e248afd217a7","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-21T21:45:28Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"25430915-7357-44e6-abfc-f882cd2b5d59","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-e584ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-e584ac/rate-test-model-e584ac\",\"requestedSubscription\":\"e2e-rate-iso-a-5a8e1f\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-21T21:45:28Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"25430915-7357-44e6-abfc-f882cd2b5d59","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e584ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-e584ac","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-5a8e1f","namespace":"ai-tenant-e2e-shared-a-e584ac","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-e584ac/rate-test-model-e584ac"}}
{"level":"debug","ts":"2026-07-21T21:45:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"25430915-7357-44e6-abfc-f882cd2b5d59","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T21:45:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"25430915-7357-44e6-abfc-f882cd2b5d59","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T21:45:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"25430915-7357-44e6-abfc-f882cd2b5d59","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T21:45:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"25430915-7357-44e6-abfc-f882cd2b5d59","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e584ac/rate-test-model-e584ac\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-e584ac/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T21:45:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"25430915-7357-44e6-abfc-f882cd2b5d59","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T21:45:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"25430915-7357-44e6-abfc-f882cd2b5d59","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-21T21:45:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"25430915-7357-44e6-abfc-f882cd2b5d59","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-5a8e1f"}
{"level":"debug","ts":"2026-07-21T21:45:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"25430915-7357-44e6-abfc-f882cd2b5d59","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-21T21:45:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"25430915-7357-44e6-abfc-f882cd2b5d59","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"ae2d348b-bd47-41ba-a3f6-e248afd217a7","keyName":"e2e-rate-a-5a8e1f","selected_subscription":"e2e-rate-iso-a-5a8e1f","selected_subscription_key":"ai-tenant-e2e-shared-a-e584ac/e2e-rate-iso-a-5a8e1f@ai-tenant-e2e-shared-a-e584ac/rate-test-model-e584ac","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-e584ac","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-5a8e1f","namespace":"ai-tenant-e2e-shared-a-e584ac","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-e584ac/rate-test-model-e584ac"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-21T21:45:28Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"25430915-7357-44e6-abfc-f882cd2b5d59","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-21T21:45:28Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"25430915-7357-44e6-abfc-f882cd2b5d59","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-21T21:45:28Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"54a7cd8b-1c59-403f-9ecc-b6ff4467f322","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.11:55418","PortSpecifier":{"PortValue":55418}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.62:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"54a7cd8b-1c59-403f-9ecc-b6ff4467f322","method":"POST","path":"/ai-tenant-e2e-shared-b-24ec74/rate-test-model-24ec74/v1/completions","host":"e2e-shared-b-24ec74.apps.0882b177-5f5b-40a6-aa64-03f78bfa7495.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-21T21:45:28Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"54a7cd8b-1c59-403f-9ecc-b6ff4467f322","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.11:55418","PortSpecifier":{"PortValue":55418}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.62:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784670328,"nanos":96254885},"http":{"id":"54a7cd8b-1c59-403f-9ecc-b6ff4467f322","method":"POST","headers":{":authority":"e2e-shared-b-24ec74.apps.0882b177-5f5b-40a6-aa64-03f78bfa7495.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-24ec74/rate-test-model-24ec74/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T21:45:28Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"54a7cd8b-1c59-403f-9ecc-b6ff4467f322","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-uncY8bs8I3eDQp7Q_U8rkKRBdozD6ttZqp8H4fg2hPgzuxnGSdT5DQnAbtDr"}
{"level":"debug","ts":"2026-07-21T21:45:28Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"54a7cd8b-1c59-403f-9ecc-b6ff4467f322","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-24ec74.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-uncY8bs8I3eDQp7Q_U8rkKRBdozD6ttZqp8H4fg2hPgzuxnGSdT5DQnAbtDr\"}"}
{"level":"debug","ts":"2026-07-21T21:45:28Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"54a7cd8b-1c59-403f-9ecc-b6ff4467f322","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-24ec74.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"fe65f7ba-d12f-4ef2-9045-d3a1823f25d8","keyName":"e2e-rate-b-5a8e1f","subscription":"e2e-rate-iso-b-5a8e1f","tenant":"e2e-shared-b-24ec74","userId":"fe65f7ba-d12f-4ef2-9045-d3a1823f25d8","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-21T21:45:28Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"54a7cd8b-1c59-403f-9ecc-b6ff4467f322","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-24ec74.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-24ec74/rate-test-model-24ec74\",\"requestedSubscription\":\"e2e-rate-iso-b-5a8e1f\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-21T21:45:28Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"54a7cd8b-1c59-403f-9ecc-b6ff4467f322","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-24ec74.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-24ec74","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-5a8e1f","namespace":"ai-tenant-e2e-shared-b-24ec74","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-b-24ec74/rate-test-model-24ec74"}}
{"level":"debug","ts":"2026-07-21T21:45:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"54a7cd8b-1c59-403f-9ecc-b6ff4467f322","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T21:45:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"54a7cd8b-1c59-403f-9ecc-b6ff4467f322","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T21:45:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"54a7cd8b-1c59-403f-9ecc-b6ff4467f322","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T21:45:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"54a7cd8b-1c59-403f-9ecc-b6ff4467f322","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T21:45:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"54a7cd8b-1c59-403f-9ecc-b6ff4467f322","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-24ec74/rate-test-model-24ec74\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-24ec74/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T21:45:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"54a7cd8b-1c59-403f-9ecc-b6ff4467f322","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-21T21:45:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"54a7cd8b-1c59-403f-9ecc-b6ff4467f322","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-21T21:45:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"54a7cd8b-1c59-403f-9ecc-b6ff4467f322","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-5a8e1f"}
{"level":"debug","ts":"2026-07-21T21:45:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"54a7cd8b-1c59-403f-9ecc-b6ff4467f322","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"fe65f7ba-d12f-4ef2-9045-d3a1823f25d8","keyName":"e2e-rate-b-5a8e1f","selected_subscription":"e2e-rate-iso-b-5a8e1f","selected_subscription_key":"ai-tenant-e2e-shared-b-24ec74/e2e-rate-iso-b-5a8e1f@ai-tenant-e2e-shared-b-24ec74/rate-test-model-24ec74","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-24ec74","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-5a8e1f","namespace":"ai-tenant-e2e-shared-b-24ec74","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-b-24ec74/rate-test-model-24ec74"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-21T21:45:28Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"54a7cd8b-1c59-403f-9ecc-b6ff4467f322","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-21T21:45:28Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"54a7cd8b-1c59-403f-9ecc-b6ff4467f322","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-21T21:45:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/67ba7d4a4e0750c8cefc0ac1bb91628e22c5c56fc2b85ae3b2b020cb93e22d04"}
{"level":"info","ts":"2026-07-21T21:45:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/874c342c102031151229c898eb1be07a38fd964e037074ffa11f2a8058e2364a"}
{"level":"info","ts":"2026-07-21T21:45:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/fe70108dc426a0506f24819396b7d387241ed4a4f93ce861260ced6a4c9f552c"}
{"level":"info","ts":"2026-07-21T21:45:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/302e1dc0be19aaa1ce92c7f02777c4c429bf7dc3006e0230b05949b46cedb38a"}
{"level":"info","ts":"2026-07-21T21:45:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/df1fe84468de7eadf9fad76e43b03e31262f2010d1ec2fe81d8ccc4db64d1701"}
{"level":"info","ts":"2026-07-21T21:45:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/fadf2ef0b02aa259c113f0684f8cac3a4eccee0437cbf5761aebdd7ca8bf9867"}
{"level":"info","ts":"2026-07-21T21:45:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ae3b03beb6ea2e155c14218f43e2c0f70c9a402f95681179ae16da400a98cf79"}
{"level":"info","ts":"2026-07-21T21:45:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/0e1ed1f5082bc96ef0e238db573c7a491fedc76ecc7f6cf790b8fa674dc24ece"}
{"level":"info","ts":"2026-07-21T21:45:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/fc7ec16ef803b9ad8b96f70509a8f61cbf15cdd74e5ce9734a9a5520e4315dff"}
{"level":"info","ts":"2026-07-21T21:45:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/15703863ca9027f27616c402c60e788b5ab1f3b7e6bf16cc9e69a95e65ccdf59"}
{"level":"info","ts":"2026-07-21T21:45:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3a07b1d8ecc43bd9cfaee018e614c34380109af366b8f3ef7948d4bd72639e1c"}
{"level":"info","ts":"2026-07-21T21:45:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/30aa3979df9cf224037df7dba54d5bd2706a256263f2d5321bda2b49bf4559d3"}
{"level":"info","ts":"2026-07-21T21:45:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ee9152050969e08dceba0086ad122b7439ef2a73e6b91bd9f76c1f78591fbeb1"}
{"level":"info","ts":"2026-07-21T21:45:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d7d88f67e527eb08038d3a8662eba8f73e3a63329157f46e3c800f8cb0d4ee47"}
{"level":"info","ts":"2026-07-21T21:45:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/87ca87d07b6391e36fc75ad181d56bde5e1de4f985d1348bbc158412ac6c92c2"}
{"level":"info","ts":"2026-07-21T21:45:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c5e5ceb446a26f012c2108544e889774c7866da5b6abca9c5e91edfbf66df930"}
{"level":"info","ts":"2026-07-21T21:45:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9a3fd8ed6321370230efc5697d6198cafec9b1c6dd1738b1f4f46966df3d7337"}
{"level":"info","ts":"2026-07-21T21:45:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e79300c14c39968a050e7fdb53f3a26106a5d07ad197b569db45b6631039faaa"}
{"level":"info","ts":"2026-07-21T21:45:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/00c2e4e88205a2a311ac4b99a87d2ef95622f0c880d3a4c486c63f3ae6faa0c7"}
{"level":"info","ts":"2026-07-21T21:45:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/350355a2450c1e457759488252d4bcc84bc412e2ac328741ee97154e4ef15c17"}
{"level":"info","ts":"2026-07-21T21:45:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4ae379c879f1ea7d7698a04c447c796690d276dbecb0425260b6b8b40c85eaea"}
{"level":"info","ts":"2026-07-21T21:45:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4f672c2cdcc1526df3d421e1d7d643464753c4f682397aaa31ad8c016c4b9d4d"}
{"level":"info","ts":"2026-07-21T21:45:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1320feba8517528c67ca3e619ad255d6442ef38867fe4bbc9d034e5c18a89a19"}
{"level":"info","ts":"2026-07-21T21:45:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4bec0f4a02137ec8564b74ba793685cb5e13b484414c385b6b09b4e2de36c997"}