--- Authorino logs from kuadrant-system (label=authorino-resource=authorino) ---
{"level":"debug","ts":"2026-07-12T20:00:13Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"63d9766f-9c60-4b9d-9718-489afc53c5b9","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-12T20:00:13Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"63d9766f-9c60-4b9d-9718-489afc53c5b9","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-12T20:00:13Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"63d9766f-9c60-4b9d-9718-489afc53c5b9","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"f539f6ce-054a-47a2-a0ef-54f768a351e3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=fc3bc2b6-ad40-4d2c-9c7e-ac1c58cf971d"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/b1708c845c3c"]}}
{"level":"debug","ts":"2026-07-12T20:00:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"63d9766f-9c60-4b9d-9718-489afc53c5b9","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/b1708c845c3c"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=fc3bc2b6-ad40-4d2c-9c7e-ac1c58cf971d"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"f539f6ce-054a-47a2-a0ef-54f768a351e3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"ee6fe41741d318ef9a23db979185da67e66f4ff7b4ced5159dd8a35df3c98c27"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.37:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-e68438.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T20:00:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"63d9766f-9c60-4b9d-9718-489afc53c5b9","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:00:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"63d9766f-9c60-4b9d-9718-489afc53c5b9","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:00:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"63d9766f-9c60-4b9d-9718-489afc53c5b9","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e68438/auth-test-model-e68438\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:00:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"63d9766f-9c60-4b9d-9718-489afc53c5b9","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-12T20:00:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"63d9766f-9c60-4b9d-9718-489afc53c5b9","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-12T20:00:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"63d9766f-9c60-4b9d-9718-489afc53c5b9","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-12T20:00:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"63d9766f-9c60-4b9d-9718-489afc53c5b9","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T20:00:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"63d9766f-9c60-4b9d-9718-489afc53c5b9","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T20:00:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7a3093f6-2035-4718-a831-388745aa4504","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:53152","PortSpecifier":{"PortValue":53152}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.63:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"7a3093f6-2035-4718-a831-388745aa4504","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-5865e5.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T20:00:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7a3093f6-2035-4718-a831-388745aa4504","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:53152","PortSpecifier":{"PortValue":53152}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.63:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783886413,"nanos":723000839},"http":{"id":"7a3093f6-2035-4718-a831-388745aa4504","method":"POST","headers":{":authority":"e2e-shared-b-5865e5.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T20:00:13Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"7a3093f6-2035-4718-a831-388745aa4504","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-12T20:00:13Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"7a3093f6-2035-4718-a831-388745aa4504","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-12T20:00:13Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"7a3093f6-2035-4718-a831-388745aa4504","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"f539f6ce-054a-47a2-a0ef-54f768a351e3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=fc3bc2b6-ad40-4d2c-9c7e-ac1c58cf971d"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/b1708c845c3c"]}}
{"level":"debug","ts":"2026-07-12T20:00:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"7a3093f6-2035-4718-a831-388745aa4504","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/b1708c845c3c"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=fc3bc2b6-ad40-4d2c-9c7e-ac1c58cf971d"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"f539f6ce-054a-47a2-a0ef-54f768a351e3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b8efafc31b6416bc2a9bedf366ecde25c30fa30b41e33922bdcfb8f1a9e8be15"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.63:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-5865e5.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T20:00:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7a3093f6-2035-4718-a831-388745aa4504","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:00:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7a3093f6-2035-4718-a831-388745aa4504","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:00:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7a3093f6-2035-4718-a831-388745aa4504","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-5865e5/auth-test-model-5865e5\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:00:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"7a3093f6-2035-4718-a831-388745aa4504","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-12T20:00:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7a3093f6-2035-4718-a831-388745aa4504","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-12T20:00:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7a3093f6-2035-4718-a831-388745aa4504","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-12T20:00:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7a3093f6-2035-4718-a831-388745aa4504","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T20:00:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7a3093f6-2035-4718-a831-388745aa4504","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T20:00:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1215205a-5453-4512-9dbb-d768852920c2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:33190","PortSpecifier":{"PortValue":33190}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.37:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1215205a-5453-4512-9dbb-d768852920c2","method":"POST","path":"/maas-api/internal/v1/subscriptions/select","host":"e2e-shared-a-e68438.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T20:00:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1215205a-5453-4512-9dbb-d768852920c2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:33190","PortSpecifier":{"PortValue":33190}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.37:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783886413,"nanos":763063536},"http":{"id":"1215205a-5453-4512-9dbb-d768852920c2","method":"POST","headers":{":authority":"e2e-shared-a-e68438.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/internal/v1/subscriptions/select",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T20:00:13Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1215205a-5453-4512-9dbb-d768852920c2","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-DWc4eFQkZ7N5vmmg_296DMiVadOljmO9NgmxITIDGsyfGdDPxfZZXmXAk0g"}
{"level":"debug","ts":"2026-07-12T20:00:13Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1215205a-5453-4512-9dbb-d768852920c2","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-e68438.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-DWc4eFQkZ7N5vmmg_296DMiVadOljmO9NgmxITIDGsyfGdDPxfZZXmXAk0g\"}"}
{"level":"debug","ts":"2026-07-12T20:00:13Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1215205a-5453-4512-9dbb-d768852920c2","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e68438.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"6621e541-4855-4e61-98e4-20af37024fa6","keyName":"e2e-auth-iso-a-b9b48a","subscription":"e2e-auth-iso-48e3eb","tenant":"e2e-shared-a-e68438","userId":"6621e541-4855-4e61-98e4-20af37024fa6","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-12T20:00:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1215205a-5453-4512-9dbb-d768852920c2","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T20:00:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1215205a-5453-4512-9dbb-d768852920c2","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:00:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1215205a-5453-4512-9dbb-d768852920c2","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:00:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1215205a-5453-4512-9dbb-d768852920c2","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e68438/auth-test-model-e68438\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:00:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"1215205a-5453-4512-9dbb-d768852920c2","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T20:00:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1215205a-5453-4512-9dbb-d768852920c2","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-12T20:00:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1215205a-5453-4512-9dbb-d768852920c2","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-auth-iso-48e3eb"}
{"level":"debug","ts":"2026-07-12T20:00:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1215205a-5453-4512-9dbb-d768852920c2","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-12T20:00:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1215205a-5453-4512-9dbb-d768852920c2","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T20:00:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1215205a-5453-4512-9dbb-d768852920c2","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T20:00:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1a90242b095f81d501f349f07cc904960c83ad27c303ba43a14277840cd60b5f"}
{"level":"info","ts":"2026-07-12T20:00:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3eb6c22d31e5891a4c4383546784afe96593096f72d9994a02510619697c89ce"}
{"level":"info","ts":"2026-07-12T20:00:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/fc48db141c9d4eb912d8c6b8c35fae007d1820146557023332146d9e34a461f5"}
{"level":"info","ts":"2026-07-12T20:00:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7d81d3b821d6b8933a4391b19d5b23433cdaaca5f30c4307487cf262ad617e2f"}
{"level":"info","ts":"2026-07-12T20:00:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/8927207f33ac4a230370128dcb8638335ceb52f894b2b88f0fa75619be070923"}
{"level":"info","ts":"2026-07-12T20:00:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/8fd090f4399d96d918e194362295d258201981812ab72ce021c9b07b66c502c8"}
{"level":"info","ts":"2026-07-12T20:00:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a33a6dfcf40404c917b9ff2695ad9fae1dbe5ea932baf0a07fe4b828fd7e63fc"}
{"level":"info","ts":"2026-07-12T20:00:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/cbbe750a17d5b71d0f9d14f1a26a361f8708159389d9aa7fea5fc17ef7b20c0a"}
{"level":"info","ts":"2026-07-12T20:00:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/43ca3cecd9189c1d426aa2bd5d9741597c809391703403c54965b0edcf8c29e2"}
{"level":"info","ts":"2026-07-12T20:00:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4ef4a87dfd71fca901fffa20830ba3426a5e5c75df162f7ccd69c4d5e6888646"}
{"level":"info","ts":"2026-07-12T20:00:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ef118c93339b4ef743fddc470b41de18858a93badde52e1618a1b23a0ef7c6eb"}
{"level":"info","ts":"2026-07-12T20:00:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7a162e5f30464620b02da89333b30ad937b7ea292f4403fbd01f50fcd83451a7"}
{"level":"info","ts":"2026-07-12T20:00:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/783607f3bc2e0fc7cd31898ecb7c3cffe15d84cdafff8c3d1465361264e52f35"}
{"level":"info","ts":"2026-07-12T20:00:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d4630b323a73bb937b63b18ea1e284c6a51110732dbe7a6c86c75e2de7f3b236"}
{"level":"info","ts":"2026-07-12T20:00:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/71b68abe5bc10709f80628aab27a007da72279e5d4cae588e54fcf74fab590a0"}
{"level":"info","ts":"2026-07-12T20:00:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/631a2c034642f3fd0683a98b052672467df18efe51b4c1ae8d39ade6eb03b89d"}
{"level":"debug","ts":"2026-07-12T20:00:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"70eb068fea86146a1e3742f7293176d195c62f0e9e8da8e3c9f0490c7b0d101e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:00:27Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:00:27Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-12T20:00:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/70eb068fea86146a1e3742f7293176d195c62f0e9e8da8e3c9f0490c7b0d101e","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:00:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"70eb068fea86146a1e3742f7293176d195c62f0e9e8da8e3c9f0490c7b0d101e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"70eb068fea86146a1e3742f7293176d195c62f0e9e8da8e3c9f0490c7b0d101e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:00:27Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:00:27Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:00:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"70eb068fea86146a1e3742f7293176d195c62f0e9e8da8e3c9f0490c7b0d101e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"70eb068fea86146a1e3742f7293176d195c62f0e9e8da8e3c9f0490c7b0d101e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:00:27Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:00:27Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:00:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/70eb068fea86146a1e3742f7293176d195c62f0e9e8da8e3c9f0490c7b0d101e"}
{"level":"error","ts":"2026-07-12T20:00:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"70eb068fea86146a1e3742f7293176d195c62f0e9e8da8e3c9f0490c7b0d101e","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"70eb068fea86146a1e3742f7293176d195c62f0e9e8da8e3c9f0490c7b0d101e\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-12T20:00:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"70eb068fea86146a1e3742f7293176d195c62f0e9e8da8e3c9f0490c7b0d101e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"70eb068fea86146a1e3742f7293176d195c62f0e9e8da8e3c9f0490c7b0d101e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/70eb068fea86146a1e3742f7293176d195c62f0e9e8da8e3c9f0490c7b0d101e","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:00:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/70eb068fea86146a1e3742f7293176d195c62f0e9e8da8e3c9f0490c7b0d101e"}
{"level":"debug","ts":"2026-07-12T20:00:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"70eb068fea86146a1e3742f7293176d195c62f0e9e8da8e3c9f0490c7b0d101e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:00:27Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:00:27Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["70eb068fea86146a1e3742f7293176d195c62f0e9e8da8e3c9f0490c7b0d101e"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:00:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"70eb068fea86146a1e3742f7293176d195c62f0e9e8da8e3c9f0490c7b0d101e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"70eb068fea86146a1e3742f7293176d195c62f0e9e8da8e3c9f0490c7b0d101e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:00:27Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:00:27Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-12T20:00:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/70eb068fea86146a1e3742f7293176d195c62f0e9e8da8e3c9f0490c7b0d101e","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:00:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"70eb068fea86146a1e3742f7293176d195c62f0e9e8da8e3c9f0490c7b0d101e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"70eb068fea86146a1e3742f7293176d195c62f0e9e8da8e3c9f0490c7b0d101e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"70eb068fea86146a1e3742f7293176d195c62f0e9e8da8e3c9f0490c7b0d101e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:00:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/70eb068fea86146a1e3742f7293176d195c62f0e9e8da8e3c9f0490c7b0d101e"}
{"level":"debug","ts":"2026-07-12T20:00:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/70eb068fea86146a1e3742f7293176d195c62f0e9e8da8e3c9f0490c7b0d101e","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:00:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"70eb068fea86146a1e3742f7293176d195c62f0e9e8da8e3c9f0490c7b0d101e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:00:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/70eb068fea86146a1e3742f7293176d195c62f0e9e8da8e3c9f0490c7b0d101e"}
{"level":"debug","ts":"2026-07-12T20:00:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"70eb068fea86146a1e3742f7293176d195c62f0e9e8da8e3c9f0490c7b0d101e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:00:27Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:00:27Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["70eb068fea86146a1e3742f7293176d195c62f0e9e8da8e3c9f0490c7b0d101e"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:00:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"70eb068fea86146a1e3742f7293176d195c62f0e9e8da8e3c9f0490c7b0d101e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"70eb068fea86146a1e3742f7293176d195c62f0e9e8da8e3c9f0490c7b0d101e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/70eb068fea86146a1e3742f7293176d195c62f0e9e8da8e3c9f0490c7b0d101e","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:00:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/70eb068fea86146a1e3742f7293176d195c62f0e9e8da8e3c9f0490c7b0d101e"}
{"level":"debug","ts":"2026-07-12T20:00:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"691e13fbb6114fee2b0ecccd3882720303e0264726c7673d733011fb644847d2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:00:27Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:00:27Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-12T20:00:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/691e13fbb6114fee2b0ecccd3882720303e0264726c7673d733011fb644847d2","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:00:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"691e13fbb6114fee2b0ecccd3882720303e0264726c7673d733011fb644847d2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"691e13fbb6114fee2b0ecccd3882720303e0264726c7673d733011fb644847d2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"691e13fbb6114fee2b0ecccd3882720303e0264726c7673d733011fb644847d2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"691e13fbb6114fee2b0ecccd3882720303e0264726c7673d733011fb644847d2","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:00:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/691e13fbb6114fee2b0ecccd3882720303e0264726c7673d733011fb644847d2"}
{"level":"debug","ts":"2026-07-12T20:00:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/691e13fbb6114fee2b0ecccd3882720303e0264726c7673d733011fb644847d2","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:00:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"691e13fbb6114fee2b0ecccd3882720303e0264726c7673d733011fb644847d2","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:00:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/691e13fbb6114fee2b0ecccd3882720303e0264726c7673d733011fb644847d2"}
{"level":"debug","ts":"2026-07-12T20:00:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a466ea25b3033d9ee28f4cb22fa9687019733c4bf419530122aa217f81025d50","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:00:27Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:00:27Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-12T20:00:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/a466ea25b3033d9ee28f4cb22fa9687019733c4bf419530122aa217f81025d50","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:00:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a466ea25b3033d9ee28f4cb22fa9687019733c4bf419530122aa217f81025d50","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a466ea25b3033d9ee28f4cb22fa9687019733c4bf419530122aa217f81025d50","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a466ea25b3033d9ee28f4cb22fa9687019733c4bf419530122aa217f81025d50","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:00:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a466ea25b3033d9ee28f4cb22fa9687019733c4bf419530122aa217f81025d50"}
{"level":"debug","ts":"2026-07-12T20:00:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/a466ea25b3033d9ee28f4cb22fa9687019733c4bf419530122aa217f81025d50","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:00:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a466ea25b3033d9ee28f4cb22fa9687019733c4bf419530122aa217f81025d50","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:00:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a466ea25b3033d9ee28f4cb22fa9687019733c4bf419530122aa217f81025d50"}
{"level":"debug","ts":"2026-07-12T20:00:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"691e13fbb6114fee2b0ecccd3882720303e0264726c7673d733011fb644847d2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:00:27Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:00:27Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["691e13fbb6114fee2b0ecccd3882720303e0264726c7673d733011fb644847d2"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:00:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"691e13fbb6114fee2b0ecccd3882720303e0264726c7673d733011fb644847d2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a466ea25b3033d9ee28f4cb22fa9687019733c4bf419530122aa217f81025d50","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:00:27Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:00:27Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a466ea25b3033d9ee28f4cb22fa9687019733c4bf419530122aa217f81025d50"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-12T20:00:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/691e13fbb6114fee2b0ecccd3882720303e0264726c7673d733011fb644847d2","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:00:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a466ea25b3033d9ee28f4cb22fa9687019733c4bf419530122aa217f81025d50","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"691e13fbb6114fee2b0ecccd3882720303e0264726c7673d733011fb644847d2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:00:27Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:00:27Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:00:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/691e13fbb6114fee2b0ecccd3882720303e0264726c7673d733011fb644847d2"}
{"level":"info","ts":"2026-07-12T20:00:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"691e13fbb6114fee2b0ecccd3882720303e0264726c7673d733011fb644847d2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a466ea25b3033d9ee28f4cb22fa9687019733c4bf419530122aa217f81025d50","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:00:27Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:00:27Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-12T20:00:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/a466ea25b3033d9ee28f4cb22fa9687019733c4bf419530122aa217f81025d50","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:00:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a466ea25b3033d9ee28f4cb22fa9687019733c4bf419530122aa217f81025d50","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"691e13fbb6114fee2b0ecccd3882720303e0264726c7673d733011fb644847d2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:00:27Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:00:27Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["691e13fbb6114fee2b0ecccd3882720303e0264726c7673d733011fb644847d2"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:00:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a466ea25b3033d9ee28f4cb22fa9687019733c4bf419530122aa217f81025d50"}
{"level":"info","ts":"2026-07-12T20:00:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"691e13fbb6114fee2b0ecccd3882720303e0264726c7673d733011fb644847d2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a466ea25b3033d9ee28f4cb22fa9687019733c4bf419530122aa217f81025d50","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:00:27Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:00:27Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a466ea25b3033d9ee28f4cb22fa9687019733c4bf419530122aa217f81025d50"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-12T20:00:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/691e13fbb6114fee2b0ecccd3882720303e0264726c7673d733011fb644847d2","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:00:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a466ea25b3033d9ee28f4cb22fa9687019733c4bf419530122aa217f81025d50","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"691e13fbb6114fee2b0ecccd3882720303e0264726c7673d733011fb644847d2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:00:27Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:00:27Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:00:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/691e13fbb6114fee2b0ecccd3882720303e0264726c7673d733011fb644847d2"}
{"level":"info","ts":"2026-07-12T20:00:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"691e13fbb6114fee2b0ecccd3882720303e0264726c7673d733011fb644847d2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a466ea25b3033d9ee28f4cb22fa9687019733c4bf419530122aa217f81025d50","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:00:27Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:00:27Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/a466ea25b3033d9ee28f4cb22fa9687019733c4bf419530122aa217f81025d50","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a466ea25b3033d9ee28f4cb22fa9687019733c4bf419530122aa217f81025d50","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"691e13fbb6114fee2b0ecccd3882720303e0264726c7673d733011fb644847d2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:00:28Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:00:28Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["691e13fbb6114fee2b0ecccd3882720303e0264726c7673d733011fb644847d2"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"691e13fbb6114fee2b0ecccd3882720303e0264726c7673d733011fb644847d2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a466ea25b3033d9ee28f4cb22fa9687019733c4bf419530122aa217f81025d50","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"691e13fbb6114fee2b0ecccd3882720303e0264726c7673d733011fb644847d2","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a466ea25b3033d9ee28f4cb22fa9687019733c4bf419530122aa217f81025d50"}
{"level":"debug","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/691e13fbb6114fee2b0ecccd3882720303e0264726c7673d733011fb644847d2","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a466ea25b3033d9ee28f4cb22fa9687019733c4bf419530122aa217f81025d50","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:00:28Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:00:28Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a466ea25b3033d9ee28f4cb22fa9687019733c4bf419530122aa217f81025d50"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a466ea25b3033d9ee28f4cb22fa9687019733c4bf419530122aa217f81025d50","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a466ea25b3033d9ee28f4cb22fa9687019733c4bf419530122aa217f81025d50","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/691e13fbb6114fee2b0ecccd3882720303e0264726c7673d733011fb644847d2"}
{"level":"debug","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/a466ea25b3033d9ee28f4cb22fa9687019733c4bf419530122aa217f81025d50","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a466ea25b3033d9ee28f4cb22fa9687019733c4bf419530122aa217f81025d50"}
{"level":"debug","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"824c9c2065ef62bcb2992bfd845c90bf44eba7c233de3fef8c36b4326a53e736","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:00:28Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:00:28Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/824c9c2065ef62bcb2992bfd845c90bf44eba7c233de3fef8c36b4326a53e736","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"824c9c2065ef62bcb2992bfd845c90bf44eba7c233de3fef8c36b4326a53e736","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"824c9c2065ef62bcb2992bfd845c90bf44eba7c233de3fef8c36b4326a53e736","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:00:28Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:00:28Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/824c9c2065ef62bcb2992bfd845c90bf44eba7c233de3fef8c36b4326a53e736"}
{"level":"info","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"824c9c2065ef62bcb2992bfd845c90bf44eba7c233de3fef8c36b4326a53e736","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"824c9c2065ef62bcb2992bfd845c90bf44eba7c233de3fef8c36b4326a53e736","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:00:28Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:00:28Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/824c9c2065ef62bcb2992bfd845c90bf44eba7c233de3fef8c36b4326a53e736","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"error","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"824c9c2065ef62bcb2992bfd845c90bf44eba7c233de3fef8c36b4326a53e736","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"824c9c2065ef62bcb2992bfd845c90bf44eba7c233de3fef8c36b4326a53e736\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"824c9c2065ef62bcb2992bfd845c90bf44eba7c233de3fef8c36b4326a53e736","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"824c9c2065ef62bcb2992bfd845c90bf44eba7c233de3fef8c36b4326a53e736","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/824c9c2065ef62bcb2992bfd845c90bf44eba7c233de3fef8c36b4326a53e736"}
{"level":"debug","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/824c9c2065ef62bcb2992bfd845c90bf44eba7c233de3fef8c36b4326a53e736","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/824c9c2065ef62bcb2992bfd845c90bf44eba7c233de3fef8c36b4326a53e736"}
{"level":"debug","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"bce9b44b62576b5e34c1006e3fd5f8bd3d106511c772a6dba163d22f683d8f8c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:00:28Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:00:28Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/bce9b44b62576b5e34c1006e3fd5f8bd3d106511c772a6dba163d22f683d8f8c","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"bce9b44b62576b5e34c1006e3fd5f8bd3d106511c772a6dba163d22f683d8f8c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"52c56b473f7339a043d70af214c965042760391de7e941dfd95cd8b349d302ae","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:00:28Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:00:28Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bce9b44b62576b5e34c1006e3fd5f8bd3d106511c772a6dba163d22f683d8f8c"}
{"level":"debug","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/52c56b473f7339a043d70af214c965042760391de7e941dfd95cd8b349d302ae","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"52c56b473f7339a043d70af214c965042760391de7e941dfd95cd8b349d302ae","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"bce9b44b62576b5e34c1006e3fd5f8bd3d106511c772a6dba163d22f683d8f8c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:00:28Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:00:28Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["bce9b44b62576b5e34c1006e3fd5f8bd3d106511c772a6dba163d22f683d8f8c"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"bce9b44b62576b5e34c1006e3fd5f8bd3d106511c772a6dba163d22f683d8f8c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"824c9c2065ef62bcb2992bfd845c90bf44eba7c233de3fef8c36b4326a53e736","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:00:28Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:00:28Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["824c9c2065ef62bcb2992bfd845c90bf44eba7c233de3fef8c36b4326a53e736"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/52c56b473f7339a043d70af214c965042760391de7e941dfd95cd8b349d302ae"}
{"level":"info","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"824c9c2065ef62bcb2992bfd845c90bf44eba7c233de3fef8c36b4326a53e736","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"52c56b473f7339a043d70af214c965042760391de7e941dfd95cd8b349d302ae","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:00:28Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:00:28Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["52c56b473f7339a043d70af214c965042760391de7e941dfd95cd8b349d302ae"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/bce9b44b62576b5e34c1006e3fd5f8bd3d106511c772a6dba163d22f683d8f8c","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"52c56b473f7339a043d70af214c965042760391de7e941dfd95cd8b349d302ae","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"bce9b44b62576b5e34c1006e3fd5f8bd3d106511c772a6dba163d22f683d8f8c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:00:28Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:00:28Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bce9b44b62576b5e34c1006e3fd5f8bd3d106511c772a6dba163d22f683d8f8c"}
{"level":"info","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"bce9b44b62576b5e34c1006e3fd5f8bd3d106511c772a6dba163d22f683d8f8c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"824c9c2065ef62bcb2992bfd845c90bf44eba7c233de3fef8c36b4326a53e736","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"52c56b473f7339a043d70af214c965042760391de7e941dfd95cd8b349d302ae","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:00:28Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:00:28Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/52c56b473f7339a043d70af214c965042760391de7e941dfd95cd8b349d302ae","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"52c56b473f7339a043d70af214c965042760391de7e941dfd95cd8b349d302ae","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"bce9b44b62576b5e34c1006e3fd5f8bd3d106511c772a6dba163d22f683d8f8c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:00:28Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:00:28Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["bce9b44b62576b5e34c1006e3fd5f8bd3d106511c772a6dba163d22f683d8f8c"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/52c56b473f7339a043d70af214c965042760391de7e941dfd95cd8b349d302ae"}
{"level":"info","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"bce9b44b62576b5e34c1006e3fd5f8bd3d106511c772a6dba163d22f683d8f8c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"52c56b473f7339a043d70af214c965042760391de7e941dfd95cd8b349d302ae","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:00:28Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:00:28Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["52c56b473f7339a043d70af214c965042760391de7e941dfd95cd8b349d302ae"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/824c9c2065ef62bcb2992bfd845c90bf44eba7c233de3fef8c36b4326a53e736","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"52c56b473f7339a043d70af214c965042760391de7e941dfd95cd8b349d302ae","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"bce9b44b62576b5e34c1006e3fd5f8bd3d106511c772a6dba163d22f683d8f8c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"52c56b473f7339a043d70af214c965042760391de7e941dfd95cd8b349d302ae","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/824c9c2065ef62bcb2992bfd845c90bf44eba7c233de3fef8c36b4326a53e736"}
{"level":"debug","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/bce9b44b62576b5e34c1006e3fd5f8bd3d106511c772a6dba163d22f683d8f8c","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bce9b44b62576b5e34c1006e3fd5f8bd3d106511c772a6dba163d22f683d8f8c"}
{"level":"debug","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/52c56b473f7339a043d70af214c965042760391de7e941dfd95cd8b349d302ae","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/52c56b473f7339a043d70af214c965042760391de7e941dfd95cd8b349d302ae"}
{"level":"debug","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"31ed2d8157851e97846b7ec73dc83fb3e20341f09d31847bfbfd47ba50d0e04b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:00:28Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:00:28Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/31ed2d8157851e97846b7ec73dc83fb3e20341f09d31847bfbfd47ba50d0e04b","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"31ed2d8157851e97846b7ec73dc83fb3e20341f09d31847bfbfd47ba50d0e04b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"31ed2d8157851e97846b7ec73dc83fb3e20341f09d31847bfbfd47ba50d0e04b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"31ed2d8157851e97846b7ec73dc83fb3e20341f09d31847bfbfd47ba50d0e04b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/31ed2d8157851e97846b7ec73dc83fb3e20341f09d31847bfbfd47ba50d0e04b"}
{"level":"debug","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/31ed2d8157851e97846b7ec73dc83fb3e20341f09d31847bfbfd47ba50d0e04b","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"31ed2d8157851e97846b7ec73dc83fb3e20341f09d31847bfbfd47ba50d0e04b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/31ed2d8157851e97846b7ec73dc83fb3e20341f09d31847bfbfd47ba50d0e04b"}
{"level":"debug","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"31ed2d8157851e97846b7ec73dc83fb3e20341f09d31847bfbfd47ba50d0e04b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:00:28Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:00:28Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["31ed2d8157851e97846b7ec73dc83fb3e20341f09d31847bfbfd47ba50d0e04b"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"31ed2d8157851e97846b7ec73dc83fb3e20341f09d31847bfbfd47ba50d0e04b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"31ed2d8157851e97846b7ec73dc83fb3e20341f09d31847bfbfd47ba50d0e04b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:00:28Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:00:28Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/31ed2d8157851e97846b7ec73dc83fb3e20341f09d31847bfbfd47ba50d0e04b","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"31ed2d8157851e97846b7ec73dc83fb3e20341f09d31847bfbfd47ba50d0e04b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"319046e4aa8326c67f39ed2db84403086e858f5e9fc752e72b1544bd3de1ab07","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:00:28Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:00:28Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"319046e4aa8326c67f39ed2db84403086e858f5e9fc752e72b1544bd3de1ab07","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"31ed2d8157851e97846b7ec73dc83fb3e20341f09d31847bfbfd47ba50d0e04b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"319046e4aa8326c67f39ed2db84403086e858f5e9fc752e72b1544bd3de1ab07","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/31ed2d8157851e97846b7ec73dc83fb3e20341f09d31847bfbfd47ba50d0e04b"}
{"level":"debug","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"319046e4aa8326c67f39ed2db84403086e858f5e9fc752e72b1544bd3de1ab07","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:00:28Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:00:28Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/319046e4aa8326c67f39ed2db84403086e858f5e9fc752e72b1544bd3de1ab07","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"319046e4aa8326c67f39ed2db84403086e858f5e9fc752e72b1544bd3de1ab07","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"31ed2d8157851e97846b7ec73dc83fb3e20341f09d31847bfbfd47ba50d0e04b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:00:28Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:00:28Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["31ed2d8157851e97846b7ec73dc83fb3e20341f09d31847bfbfd47ba50d0e04b"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/319046e4aa8326c67f39ed2db84403086e858f5e9fc752e72b1544bd3de1ab07"}
{"level":"info","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"31ed2d8157851e97846b7ec73dc83fb3e20341f09d31847bfbfd47ba50d0e04b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"319046e4aa8326c67f39ed2db84403086e858f5e9fc752e72b1544bd3de1ab07","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:00:28Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:00:28Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["319046e4aa8326c67f39ed2db84403086e858f5e9fc752e72b1544bd3de1ab07"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/31ed2d8157851e97846b7ec73dc83fb3e20341f09d31847bfbfd47ba50d0e04b","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"319046e4aa8326c67f39ed2db84403086e858f5e9fc752e72b1544bd3de1ab07","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"31ed2d8157851e97846b7ec73dc83fb3e20341f09d31847bfbfd47ba50d0e04b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:00:28Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:00:28Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/31ed2d8157851e97846b7ec73dc83fb3e20341f09d31847bfbfd47ba50d0e04b"}
{"level":"info","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"31ed2d8157851e97846b7ec73dc83fb3e20341f09d31847bfbfd47ba50d0e04b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"319046e4aa8326c67f39ed2db84403086e858f5e9fc752e72b1544bd3de1ab07","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:00:28Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:00:28Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/319046e4aa8326c67f39ed2db84403086e858f5e9fc752e72b1544bd3de1ab07","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"319046e4aa8326c67f39ed2db84403086e858f5e9fc752e72b1544bd3de1ab07","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"31ed2d8157851e97846b7ec73dc83fb3e20341f09d31847bfbfd47ba50d0e04b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:00:28Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:00:28Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["31ed2d8157851e97846b7ec73dc83fb3e20341f09d31847bfbfd47ba50d0e04b"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/319046e4aa8326c67f39ed2db84403086e858f5e9fc752e72b1544bd3de1ab07"}
{"level":"info","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"31ed2d8157851e97846b7ec73dc83fb3e20341f09d31847bfbfd47ba50d0e04b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"319046e4aa8326c67f39ed2db84403086e858f5e9fc752e72b1544bd3de1ab07","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:00:28Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:00:28Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["319046e4aa8326c67f39ed2db84403086e858f5e9fc752e72b1544bd3de1ab07"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/31ed2d8157851e97846b7ec73dc83fb3e20341f09d31847bfbfd47ba50d0e04b","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"319046e4aa8326c67f39ed2db84403086e858f5e9fc752e72b1544bd3de1ab07","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"31ed2d8157851e97846b7ec73dc83fb3e20341f09d31847bfbfd47ba50d0e04b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:00:28Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:00:28Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/31ed2d8157851e97846b7ec73dc83fb3e20341f09d31847bfbfd47ba50d0e04b"}
{"level":"info","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"31ed2d8157851e97846b7ec73dc83fb3e20341f09d31847bfbfd47ba50d0e04b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"319046e4aa8326c67f39ed2db84403086e858f5e9fc752e72b1544bd3de1ab07","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:00:28Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:00:28Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/319046e4aa8326c67f39ed2db84403086e858f5e9fc752e72b1544bd3de1ab07","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"319046e4aa8326c67f39ed2db84403086e858f5e9fc752e72b1544bd3de1ab07","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"31ed2d8157851e97846b7ec73dc83fb3e20341f09d31847bfbfd47ba50d0e04b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:00:28Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:00:28Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["31ed2d8157851e97846b7ec73dc83fb3e20341f09d31847bfbfd47ba50d0e04b"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/319046e4aa8326c67f39ed2db84403086e858f5e9fc752e72b1544bd3de1ab07"}
{"level":"info","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"31ed2d8157851e97846b7ec73dc83fb3e20341f09d31847bfbfd47ba50d0e04b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"319046e4aa8326c67f39ed2db84403086e858f5e9fc752e72b1544bd3de1ab07","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:00:28Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:00:28Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["319046e4aa8326c67f39ed2db84403086e858f5e9fc752e72b1544bd3de1ab07"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/31ed2d8157851e97846b7ec73dc83fb3e20341f09d31847bfbfd47ba50d0e04b","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"319046e4aa8326c67f39ed2db84403086e858f5e9fc752e72b1544bd3de1ab07","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"31ed2d8157851e97846b7ec73dc83fb3e20341f09d31847bfbfd47ba50d0e04b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:00:28Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:00:28Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/31ed2d8157851e97846b7ec73dc83fb3e20341f09d31847bfbfd47ba50d0e04b"}
{"level":"debug","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/319046e4aa8326c67f39ed2db84403086e858f5e9fc752e72b1544bd3de1ab07","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"31ed2d8157851e97846b7ec73dc83fb3e20341f09d31847bfbfd47ba50d0e04b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"319046e4aa8326c67f39ed2db84403086e858f5e9fc752e72b1544bd3de1ab07","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:00:28Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:00:28Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"319046e4aa8326c67f39ed2db84403086e858f5e9fc752e72b1544bd3de1ab07","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"31ed2d8157851e97846b7ec73dc83fb3e20341f09d31847bfbfd47ba50d0e04b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:00:28Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:00:28Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["31ed2d8157851e97846b7ec73dc83fb3e20341f09d31847bfbfd47ba50d0e04b"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/319046e4aa8326c67f39ed2db84403086e858f5e9fc752e72b1544bd3de1ab07"}
{"level":"debug","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/31ed2d8157851e97846b7ec73dc83fb3e20341f09d31847bfbfd47ba50d0e04b","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"31ed2d8157851e97846b7ec73dc83fb3e20341f09d31847bfbfd47ba50d0e04b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"319046e4aa8326c67f39ed2db84403086e858f5e9fc752e72b1544bd3de1ab07","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:00:28Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:00:28Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["319046e4aa8326c67f39ed2db84403086e858f5e9fc752e72b1544bd3de1ab07"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"319046e4aa8326c67f39ed2db84403086e858f5e9fc752e72b1544bd3de1ab07","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"31ed2d8157851e97846b7ec73dc83fb3e20341f09d31847bfbfd47ba50d0e04b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:00:28Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:00:28Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/31ed2d8157851e97846b7ec73dc83fb3e20341f09d31847bfbfd47ba50d0e04b"}
{"level":"debug","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/319046e4aa8326c67f39ed2db84403086e858f5e9fc752e72b1544bd3de1ab07","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"31ed2d8157851e97846b7ec73dc83fb3e20341f09d31847bfbfd47ba50d0e04b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"319046e4aa8326c67f39ed2db84403086e858f5e9fc752e72b1544bd3de1ab07","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:00:28Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:00:28Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"319046e4aa8326c67f39ed2db84403086e858f5e9fc752e72b1544bd3de1ab07","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"31ed2d8157851e97846b7ec73dc83fb3e20341f09d31847bfbfd47ba50d0e04b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:00:28Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:00:28Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["31ed2d8157851e97846b7ec73dc83fb3e20341f09d31847bfbfd47ba50d0e04b"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/319046e4aa8326c67f39ed2db84403086e858f5e9fc752e72b1544bd3de1ab07"}
{"level":"debug","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/31ed2d8157851e97846b7ec73dc83fb3e20341f09d31847bfbfd47ba50d0e04b","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"31ed2d8157851e97846b7ec73dc83fb3e20341f09d31847bfbfd47ba50d0e04b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"319046e4aa8326c67f39ed2db84403086e858f5e9fc752e72b1544bd3de1ab07","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:00:28Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:00:28Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["319046e4aa8326c67f39ed2db84403086e858f5e9fc752e72b1544bd3de1ab07"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"319046e4aa8326c67f39ed2db84403086e858f5e9fc752e72b1544bd3de1ab07","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"31ed2d8157851e97846b7ec73dc83fb3e20341f09d31847bfbfd47ba50d0e04b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:00:28Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:00:28Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"31ed2d8157851e97846b7ec73dc83fb3e20341f09d31847bfbfd47ba50d0e04b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"319046e4aa8326c67f39ed2db84403086e858f5e9fc752e72b1544bd3de1ab07","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"31ed2d8157851e97846b7ec73dc83fb3e20341f09d31847bfbfd47ba50d0e04b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"31ed2d8157851e97846b7ec73dc83fb3e20341f09d31847bfbfd47ba50d0e04b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/31ed2d8157851e97846b7ec73dc83fb3e20341f09d31847bfbfd47ba50d0e04b"}
{"level":"debug","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"31ed2d8157851e97846b7ec73dc83fb3e20341f09d31847bfbfd47ba50d0e04b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:00:28Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:00:28Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["31ed2d8157851e97846b7ec73dc83fb3e20341f09d31847bfbfd47ba50d0e04b"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/319046e4aa8326c67f39ed2db84403086e858f5e9fc752e72b1544bd3de1ab07","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"31ed2d8157851e97846b7ec73dc83fb3e20341f09d31847bfbfd47ba50d0e04b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"31ed2d8157851e97846b7ec73dc83fb3e20341f09d31847bfbfd47ba50d0e04b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/319046e4aa8326c67f39ed2db84403086e858f5e9fc752e72b1544bd3de1ab07"}
{"level":"debug","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/31ed2d8157851e97846b7ec73dc83fb3e20341f09d31847bfbfd47ba50d0e04b","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:00:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/31ed2d8157851e97846b7ec73dc83fb3e20341f09d31847bfbfd47ba50d0e04b"}
{"level":"debug","ts":"2026-07-12T20:00:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8589e34592f19f4e51845be1f42094866a764af48316124682f6ce3341e75651","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:00:54Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:00:54Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-12T20:00:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/8589e34592f19f4e51845be1f42094866a764af48316124682f6ce3341e75651","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:00:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8589e34592f19f4e51845be1f42094866a764af48316124682f6ce3341e75651","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8589e34592f19f4e51845be1f42094866a764af48316124682f6ce3341e75651","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:00:54Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:00:54Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:00:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8589e34592f19f4e51845be1f42094866a764af48316124682f6ce3341e75651","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8589e34592f19f4e51845be1f42094866a764af48316124682f6ce3341e75651","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:00:54Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:00:54Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:00:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8589e34592f19f4e51845be1f42094866a764af48316124682f6ce3341e75651"}
{"level":"error","ts":"2026-07-12T20:00:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"8589e34592f19f4e51845be1f42094866a764af48316124682f6ce3341e75651","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"8589e34592f19f4e51845be1f42094866a764af48316124682f6ce3341e75651\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-12T20:00:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8589e34592f19f4e51845be1f42094866a764af48316124682f6ce3341e75651","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/8589e34592f19f4e51845be1f42094866a764af48316124682f6ce3341e75651","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:00:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8589e34592f19f4e51845be1f42094866a764af48316124682f6ce3341e75651","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:00:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8589e34592f19f4e51845be1f42094866a764af48316124682f6ce3341e75651"}
{"level":"debug","ts":"2026-07-12T20:00:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8589e34592f19f4e51845be1f42094866a764af48316124682f6ce3341e75651","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:00:54Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:00:54Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8589e34592f19f4e51845be1f42094866a764af48316124682f6ce3341e75651"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:00:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8589e34592f19f4e51845be1f42094866a764af48316124682f6ce3341e75651","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8589e34592f19f4e51845be1f42094866a764af48316124682f6ce3341e75651","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:00:54Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:00:54Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-12T20:00:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/8589e34592f19f4e51845be1f42094866a764af48316124682f6ce3341e75651","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:00:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8589e34592f19f4e51845be1f42094866a764af48316124682f6ce3341e75651","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8589e34592f19f4e51845be1f42094866a764af48316124682f6ce3341e75651","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8589e34592f19f4e51845be1f42094866a764af48316124682f6ce3341e75651","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:00:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8589e34592f19f4e51845be1f42094866a764af48316124682f6ce3341e75651"}
{"level":"debug","ts":"2026-07-12T20:00:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/8589e34592f19f4e51845be1f42094866a764af48316124682f6ce3341e75651","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:00:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8589e34592f19f4e51845be1f42094866a764af48316124682f6ce3341e75651","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:00:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8589e34592f19f4e51845be1f42094866a764af48316124682f6ce3341e75651"}
{"level":"debug","ts":"2026-07-12T20:00:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8589e34592f19f4e51845be1f42094866a764af48316124682f6ce3341e75651","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:00:54Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:00:54Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8589e34592f19f4e51845be1f42094866a764af48316124682f6ce3341e75651"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:00:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8589e34592f19f4e51845be1f42094866a764af48316124682f6ce3341e75651","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8589e34592f19f4e51845be1f42094866a764af48316124682f6ce3341e75651","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:00:54Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:00:54Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-12T20:00:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/8589e34592f19f4e51845be1f42094866a764af48316124682f6ce3341e75651","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:00:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8589e34592f19f4e51845be1f42094866a764af48316124682f6ce3341e75651","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8589e34592f19f4e51845be1f42094866a764af48316124682f6ce3341e75651","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8589e34592f19f4e51845be1f42094866a764af48316124682f6ce3341e75651","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:00:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8589e34592f19f4e51845be1f42094866a764af48316124682f6ce3341e75651"}
{"level":"debug","ts":"2026-07-12T20:00:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/8589e34592f19f4e51845be1f42094866a764af48316124682f6ce3341e75651","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:00:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8589e34592f19f4e51845be1f42094866a764af48316124682f6ce3341e75651","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:00:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8589e34592f19f4e51845be1f42094866a764af48316124682f6ce3341e75651"}
{"level":"debug","ts":"2026-07-12T20:00:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8589e34592f19f4e51845be1f42094866a764af48316124682f6ce3341e75651","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:00:54Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:00:54Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8589e34592f19f4e51845be1f42094866a764af48316124682f6ce3341e75651"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:00:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8589e34592f19f4e51845be1f42094866a764af48316124682f6ce3341e75651","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8589e34592f19f4e51845be1f42094866a764af48316124682f6ce3341e75651","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:00:54Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:00:54Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-12T20:00:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/8589e34592f19f4e51845be1f42094866a764af48316124682f6ce3341e75651","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:00:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8589e34592f19f4e51845be1f42094866a764af48316124682f6ce3341e75651","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8589e34592f19f4e51845be1f42094866a764af48316124682f6ce3341e75651","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8589e34592f19f4e51845be1f42094866a764af48316124682f6ce3341e75651","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:00:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8589e34592f19f4e51845be1f42094866a764af48316124682f6ce3341e75651"}
{"level":"debug","ts":"2026-07-12T20:00:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/8589e34592f19f4e51845be1f42094866a764af48316124682f6ce3341e75651","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8589e34592f19f4e51845be1f42094866a764af48316124682f6ce3341e75651","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8589e34592f19f4e51845be1f42094866a764af48316124682f6ce3341e75651"}
{"level":"debug","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3457cbea8279a3e53f1ed121353b49f6f8875108ae6e78b1d0a953332af06d8f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:00:55Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:00:55Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/3457cbea8279a3e53f1ed121353b49f6f8875108ae6e78b1d0a953332af06d8f","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3457cbea8279a3e53f1ed121353b49f6f8875108ae6e78b1d0a953332af06d8f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8589e34592f19f4e51845be1f42094866a764af48316124682f6ce3341e75651","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:00:55Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:00:55Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8589e34592f19f4e51845be1f42094866a764af48316124682f6ce3341e75651"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3457cbea8279a3e53f1ed121353b49f6f8875108ae6e78b1d0a953332af06d8f"}
{"level":"info","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8589e34592f19f4e51845be1f42094866a764af48316124682f6ce3341e75651","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3457cbea8279a3e53f1ed121353b49f6f8875108ae6e78b1d0a953332af06d8f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8589e34592f19f4e51845be1f42094866a764af48316124682f6ce3341e75651","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/3457cbea8279a3e53f1ed121353b49f6f8875108ae6e78b1d0a953332af06d8f","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3457cbea8279a3e53f1ed121353b49f6f8875108ae6e78b1d0a953332af06d8f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3457cbea8279a3e53f1ed121353b49f6f8875108ae6e78b1d0a953332af06d8f"}
{"level":"debug","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/8589e34592f19f4e51845be1f42094866a764af48316124682f6ce3341e75651","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3457cbea8279a3e53f1ed121353b49f6f8875108ae6e78b1d0a953332af06d8f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:00:55Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:00:55Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3457cbea8279a3e53f1ed121353b49f6f8875108ae6e78b1d0a953332af06d8f"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3457cbea8279a3e53f1ed121353b49f6f8875108ae6e78b1d0a953332af06d8f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3457cbea8279a3e53f1ed121353b49f6f8875108ae6e78b1d0a953332af06d8f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8589e34592f19f4e51845be1f42094866a764af48316124682f6ce3341e75651"}
{"level":"debug","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/3457cbea8279a3e53f1ed121353b49f6f8875108ae6e78b1d0a953332af06d8f","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3457cbea8279a3e53f1ed121353b49f6f8875108ae6e78b1d0a953332af06d8f"}
{"level":"debug","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"31743c49ad9adc66aaa61cf2532157588601e99688a1987c3e96852a413ce2a5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:00:55Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:00:55Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/31743c49ad9adc66aaa61cf2532157588601e99688a1987c3e96852a413ce2a5","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"31743c49ad9adc66aaa61cf2532157588601e99688a1987c3e96852a413ce2a5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"31743c49ad9adc66aaa61cf2532157588601e99688a1987c3e96852a413ce2a5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"31743c49ad9adc66aaa61cf2532157588601e99688a1987c3e96852a413ce2a5","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/31743c49ad9adc66aaa61cf2532157588601e99688a1987c3e96852a413ce2a5"}
{"level":"debug","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/31743c49ad9adc66aaa61cf2532157588601e99688a1987c3e96852a413ce2a5","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"31743c49ad9adc66aaa61cf2532157588601e99688a1987c3e96852a413ce2a5","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/31743c49ad9adc66aaa61cf2532157588601e99688a1987c3e96852a413ce2a5"}
{"level":"debug","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"31743c49ad9adc66aaa61cf2532157588601e99688a1987c3e96852a413ce2a5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:00:55Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:00:55Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["31743c49ad9adc66aaa61cf2532157588601e99688a1987c3e96852a413ce2a5"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"31743c49ad9adc66aaa61cf2532157588601e99688a1987c3e96852a413ce2a5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"31743c49ad9adc66aaa61cf2532157588601e99688a1987c3e96852a413ce2a5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:00:55Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:00:55Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/31743c49ad9adc66aaa61cf2532157588601e99688a1987c3e96852a413ce2a5","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"31743c49ad9adc66aaa61cf2532157588601e99688a1987c3e96852a413ce2a5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2e88668e949b20e17646ca2ec685317a90fcd3921811f5ac2e99cf5f3ab1d12d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:00:55Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:00:55Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2e88668e949b20e17646ca2ec685317a90fcd3921811f5ac2e99cf5f3ab1d12d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"31743c49ad9adc66aaa61cf2532157588601e99688a1987c3e96852a413ce2a5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2e88668e949b20e17646ca2ec685317a90fcd3921811f5ac2e99cf5f3ab1d12d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/31743c49ad9adc66aaa61cf2532157588601e99688a1987c3e96852a413ce2a5"}
{"level":"debug","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/2e88668e949b20e17646ca2ec685317a90fcd3921811f5ac2e99cf5f3ab1d12d","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2e88668e949b20e17646ca2ec685317a90fcd3921811f5ac2e99cf5f3ab1d12d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:00:55Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:00:55Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2e88668e949b20e17646ca2ec685317a90fcd3921811f5ac2e99cf5f3ab1d12d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"31743c49ad9adc66aaa61cf2532157588601e99688a1987c3e96852a413ce2a5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:00:55Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:00:55Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["31743c49ad9adc66aaa61cf2532157588601e99688a1987c3e96852a413ce2a5"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2e88668e949b20e17646ca2ec685317a90fcd3921811f5ac2e99cf5f3ab1d12d"}
{"level":"info","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"31743c49ad9adc66aaa61cf2532157588601e99688a1987c3e96852a413ce2a5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2e88668e949b20e17646ca2ec685317a90fcd3921811f5ac2e99cf5f3ab1d12d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:00:55Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:00:55Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["2e88668e949b20e17646ca2ec685317a90fcd3921811f5ac2e99cf5f3ab1d12d"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/31743c49ad9adc66aaa61cf2532157588601e99688a1987c3e96852a413ce2a5","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2e88668e949b20e17646ca2ec685317a90fcd3921811f5ac2e99cf5f3ab1d12d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"31743c49ad9adc66aaa61cf2532157588601e99688a1987c3e96852a413ce2a5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:00:55Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:00:55Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/31743c49ad9adc66aaa61cf2532157588601e99688a1987c3e96852a413ce2a5"}
{"level":"info","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"31743c49ad9adc66aaa61cf2532157588601e99688a1987c3e96852a413ce2a5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2e88668e949b20e17646ca2ec685317a90fcd3921811f5ac2e99cf5f3ab1d12d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:00:55Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:00:55Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/2e88668e949b20e17646ca2ec685317a90fcd3921811f5ac2e99cf5f3ab1d12d","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2e88668e949b20e17646ca2ec685317a90fcd3921811f5ac2e99cf5f3ab1d12d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"31743c49ad9adc66aaa61cf2532157588601e99688a1987c3e96852a413ce2a5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:00:55Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:00:55Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["31743c49ad9adc66aaa61cf2532157588601e99688a1987c3e96852a413ce2a5"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2e88668e949b20e17646ca2ec685317a90fcd3921811f5ac2e99cf5f3ab1d12d"}
{"level":"debug","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/31743c49ad9adc66aaa61cf2532157588601e99688a1987c3e96852a413ce2a5","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"31743c49ad9adc66aaa61cf2532157588601e99688a1987c3e96852a413ce2a5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2e88668e949b20e17646ca2ec685317a90fcd3921811f5ac2e99cf5f3ab1d12d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:00:55Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:00:55Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["2e88668e949b20e17646ca2ec685317a90fcd3921811f5ac2e99cf5f3ab1d12d"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2e88668e949b20e17646ca2ec685317a90fcd3921811f5ac2e99cf5f3ab1d12d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c09b55b1f90fb3d7000f8402aa12528c517b8c63ddea45ee7685f92f8bbcd413","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:00:55Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:00:55Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/31743c49ad9adc66aaa61cf2532157588601e99688a1987c3e96852a413ce2a5"}
{"level":"debug","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/2e88668e949b20e17646ca2ec685317a90fcd3921811f5ac2e99cf5f3ab1d12d","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c09b55b1f90fb3d7000f8402aa12528c517b8c63ddea45ee7685f92f8bbcd413","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"31743c49ad9adc66aaa61cf2532157588601e99688a1987c3e96852a413ce2a5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2e88668e949b20e17646ca2ec685317a90fcd3921811f5ac2e99cf5f3ab1d12d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:00:55Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:00:55Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2e88668e949b20e17646ca2ec685317a90fcd3921811f5ac2e99cf5f3ab1d12d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c09b55b1f90fb3d7000f8402aa12528c517b8c63ddea45ee7685f92f8bbcd413","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2e88668e949b20e17646ca2ec685317a90fcd3921811f5ac2e99cf5f3ab1d12d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2e88668e949b20e17646ca2ec685317a90fcd3921811f5ac2e99cf5f3ab1d12d"}
{"level":"debug","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2e88668e949b20e17646ca2ec685317a90fcd3921811f5ac2e99cf5f3ab1d12d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:00:55Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:00:55Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["2e88668e949b20e17646ca2ec685317a90fcd3921811f5ac2e99cf5f3ab1d12d"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/c09b55b1f90fb3d7000f8402aa12528c517b8c63ddea45ee7685f92f8bbcd413","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2e88668e949b20e17646ca2ec685317a90fcd3921811f5ac2e99cf5f3ab1d12d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c09b55b1f90fb3d7000f8402aa12528c517b8c63ddea45ee7685f92f8bbcd413","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:00:55Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:00:55Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c09b55b1f90fb3d7000f8402aa12528c517b8c63ddea45ee7685f92f8bbcd413"}
{"level":"info","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c09b55b1f90fb3d7000f8402aa12528c517b8c63ddea45ee7685f92f8bbcd413","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2e88668e949b20e17646ca2ec685317a90fcd3921811f5ac2e99cf5f3ab1d12d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c09b55b1f90fb3d7000f8402aa12528c517b8c63ddea45ee7685f92f8bbcd413","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:00:55Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:00:55Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c09b55b1f90fb3d7000f8402aa12528c517b8c63ddea45ee7685f92f8bbcd413"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/31743c49ad9adc66aaa61cf2532157588601e99688a1987c3e96852a413ce2a5","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c09b55b1f90fb3d7000f8402aa12528c517b8c63ddea45ee7685f92f8bbcd413","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c09b55b1f90fb3d7000f8402aa12528c517b8c63ddea45ee7685f92f8bbcd413","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c09b55b1f90fb3d7000f8402aa12528c517b8c63ddea45ee7685f92f8bbcd413","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/31743c49ad9adc66aaa61cf2532157588601e99688a1987c3e96852a413ce2a5"}
{"level":"debug","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ff7c1a2c5dc6f3760951fde0ab72cc36bd0cea4d46861e780f45f15fed7451b3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:00:55Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:00:55Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/2e88668e949b20e17646ca2ec685317a90fcd3921811f5ac2e99cf5f3ab1d12d","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ff7c1a2c5dc6f3760951fde0ab72cc36bd0cea4d46861e780f45f15fed7451b3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"926aa4279f89deb74202d57b5dc0403904fbba9c530afe4129683cbc9b7c7852","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:00:55Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:00:55Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2e88668e949b20e17646ca2ec685317a90fcd3921811f5ac2e99cf5f3ab1d12d"}
{"level":"info","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"926aa4279f89deb74202d57b5dc0403904fbba9c530afe4129683cbc9b7c7852","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ff7c1a2c5dc6f3760951fde0ab72cc36bd0cea4d46861e780f45f15fed7451b3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/c09b55b1f90fb3d7000f8402aa12528c517b8c63ddea45ee7685f92f8bbcd413","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"926aa4279f89deb74202d57b5dc0403904fbba9c530afe4129683cbc9b7c7852","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"926aa4279f89deb74202d57b5dc0403904fbba9c530afe4129683cbc9b7c7852","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ff7c1a2c5dc6f3760951fde0ab72cc36bd0cea4d46861e780f45f15fed7451b3","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c09b55b1f90fb3d7000f8402aa12528c517b8c63ddea45ee7685f92f8bbcd413"}
{"level":"debug","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/ff7c1a2c5dc6f3760951fde0ab72cc36bd0cea4d46861e780f45f15fed7451b3","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"926aa4279f89deb74202d57b5dc0403904fbba9c530afe4129683cbc9b7c7852","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ff7c1a2c5dc6f3760951fde0ab72cc36bd0cea4d46861e780f45f15fed7451b3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:00:55Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:00:55Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ff7c1a2c5dc6f3760951fde0ab72cc36bd0cea4d46861e780f45f15fed7451b3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ff7c1a2c5dc6f3760951fde0ab72cc36bd0cea4d46861e780f45f15fed7451b3","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ff7c1a2c5dc6f3760951fde0ab72cc36bd0cea4d46861e780f45f15fed7451b3"}
{"level":"debug","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/926aa4279f89deb74202d57b5dc0403904fbba9c530afe4129683cbc9b7c7852","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"926aa4279f89deb74202d57b5dc0403904fbba9c530afe4129683cbc9b7c7852","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:00:55Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:00:55Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/926aa4279f89deb74202d57b5dc0403904fbba9c530afe4129683cbc9b7c7852"}
{"level":"debug","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/ff7c1a2c5dc6f3760951fde0ab72cc36bd0cea4d46861e780f45f15fed7451b3","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"926aa4279f89deb74202d57b5dc0403904fbba9c530afe4129683cbc9b7c7852","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e7414a0af14752915aff762b99a3b907fa0d83e6d971480783a04dce9faef697","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:00:55Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:00:55Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e7414a0af14752915aff762b99a3b907fa0d83e6d971480783a04dce9faef697","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"926aa4279f89deb74202d57b5dc0403904fbba9c530afe4129683cbc9b7c7852","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:00:55Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:00:55Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["926aa4279f89deb74202d57b5dc0403904fbba9c530afe4129683cbc9b7c7852"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ff7c1a2c5dc6f3760951fde0ab72cc36bd0cea4d46861e780f45f15fed7451b3"}
{"level":"debug","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/e7414a0af14752915aff762b99a3b907fa0d83e6d971480783a04dce9faef697","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"926aa4279f89deb74202d57b5dc0403904fbba9c530afe4129683cbc9b7c7852","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ff7c1a2c5dc6f3760951fde0ab72cc36bd0cea4d46861e780f45f15fed7451b3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:00:55Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:00:55Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ff7c1a2c5dc6f3760951fde0ab72cc36bd0cea4d46861e780f45f15fed7451b3"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e7414a0af14752915aff762b99a3b907fa0d83e6d971480783a04dce9faef697"}
{"level":"info","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ff7c1a2c5dc6f3760951fde0ab72cc36bd0cea4d46861e780f45f15fed7451b3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e7414a0af14752915aff762b99a3b907fa0d83e6d971480783a04dce9faef697","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:00:55Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:00:55Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e7414a0af14752915aff762b99a3b907fa0d83e6d971480783a04dce9faef697"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/926aa4279f89deb74202d57b5dc0403904fbba9c530afe4129683cbc9b7c7852","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e7414a0af14752915aff762b99a3b907fa0d83e6d971480783a04dce9faef697","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"926aa4279f89deb74202d57b5dc0403904fbba9c530afe4129683cbc9b7c7852","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:00:55Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:00:55Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/926aa4279f89deb74202d57b5dc0403904fbba9c530afe4129683cbc9b7c7852"}
{"level":"info","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"926aa4279f89deb74202d57b5dc0403904fbba9c530afe4129683cbc9b7c7852","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ff7c1a2c5dc6f3760951fde0ab72cc36bd0cea4d46861e780f45f15fed7451b3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:00:55Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:00:55Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/ff7c1a2c5dc6f3760951fde0ab72cc36bd0cea4d46861e780f45f15fed7451b3","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ff7c1a2c5dc6f3760951fde0ab72cc36bd0cea4d46861e780f45f15fed7451b3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e7414a0af14752915aff762b99a3b907fa0d83e6d971480783a04dce9faef697","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"926aa4279f89deb74202d57b5dc0403904fbba9c530afe4129683cbc9b7c7852","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:00:55Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:00:55Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["926aa4279f89deb74202d57b5dc0403904fbba9c530afe4129683cbc9b7c7852"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ff7c1a2c5dc6f3760951fde0ab72cc36bd0cea4d46861e780f45f15fed7451b3"}
{"level":"debug","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/e7414a0af14752915aff762b99a3b907fa0d83e6d971480783a04dce9faef697","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"926aa4279f89deb74202d57b5dc0403904fbba9c530afe4129683cbc9b7c7852","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ff7c1a2c5dc6f3760951fde0ab72cc36bd0cea4d46861e780f45f15fed7451b3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:00:55Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:00:55Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ff7c1a2c5dc6f3760951fde0ab72cc36bd0cea4d46861e780f45f15fed7451b3"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ff7c1a2c5dc6f3760951fde0ab72cc36bd0cea4d46861e780f45f15fed7451b3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"926aa4279f89deb74202d57b5dc0403904fbba9c530afe4129683cbc9b7c7852","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ff7c1a2c5dc6f3760951fde0ab72cc36bd0cea4d46861e780f45f15fed7451b3","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e7414a0af14752915aff762b99a3b907fa0d83e6d971480783a04dce9faef697"}
{"level":"debug","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/926aa4279f89deb74202d57b5dc0403904fbba9c530afe4129683cbc9b7c7852","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/926aa4279f89deb74202d57b5dc0403904fbba9c530afe4129683cbc9b7c7852"}
{"level":"debug","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/ff7c1a2c5dc6f3760951fde0ab72cc36bd0cea4d46861e780f45f15fed7451b3","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:00:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ff7c1a2c5dc6f3760951fde0ab72cc36bd0cea4d46861e780f45f15fed7451b3"}
{"level":"debug","ts":"2026-07-12T20:01:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"319046e4aa8326c67f39ed2db84403086e858f5e9fc752e72b1544bd3de1ab07","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:01:08Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:01:08Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-12T20:01:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/319046e4aa8326c67f39ed2db84403086e858f5e9fc752e72b1544bd3de1ab07","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:01:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"319046e4aa8326c67f39ed2db84403086e858f5e9fc752e72b1544bd3de1ab07","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:01:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"319046e4aa8326c67f39ed2db84403086e858f5e9fc752e72b1544bd3de1ab07","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:01:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"319046e4aa8326c67f39ed2db84403086e858f5e9fc752e72b1544bd3de1ab07","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:01:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/319046e4aa8326c67f39ed2db84403086e858f5e9fc752e72b1544bd3de1ab07"}
{"level":"debug","ts":"2026-07-12T20:01:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"319046e4aa8326c67f39ed2db84403086e858f5e9fc752e72b1544bd3de1ab07","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:01:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/319046e4aa8326c67f39ed2db84403086e858f5e9fc752e72b1544bd3de1ab07","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:01:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"319046e4aa8326c67f39ed2db84403086e858f5e9fc752e72b1544bd3de1ab07","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:01:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/319046e4aa8326c67f39ed2db84403086e858f5e9fc752e72b1544bd3de1ab07"}
{"level":"debug","ts":"2026-07-12T20:01:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"319046e4aa8326c67f39ed2db84403086e858f5e9fc752e72b1544bd3de1ab07","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:01:09Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:01:09Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["319046e4aa8326c67f39ed2db84403086e858f5e9fc752e72b1544bd3de1ab07"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:01:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"319046e4aa8326c67f39ed2db84403086e858f5e9fc752e72b1544bd3de1ab07","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:01:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"319046e4aa8326c67f39ed2db84403086e858f5e9fc752e72b1544bd3de1ab07","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:01:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/319046e4aa8326c67f39ed2db84403086e858f5e9fc752e72b1544bd3de1ab07","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:01:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/319046e4aa8326c67f39ed2db84403086e858f5e9fc752e72b1544bd3de1ab07"}
{"level":"debug","ts":"2026-07-12T20:01:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"926aa4279f89deb74202d57b5dc0403904fbba9c530afe4129683cbc9b7c7852","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:01:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/926aa4279f89deb74202d57b5dc0403904fbba9c530afe4129683cbc9b7c7852","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:01:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/926aa4279f89deb74202d57b5dc0403904fbba9c530afe4129683cbc9b7c7852"}
{"level":"debug","ts":"2026-07-12T20:01:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ff7c1a2c5dc6f3760951fde0ab72cc36bd0cea4d46861e780f45f15fed7451b3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:01:09Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:01:09Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-12T20:01:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/ff7c1a2c5dc6f3760951fde0ab72cc36bd0cea4d46861e780f45f15fed7451b3","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:01:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ff7c1a2c5dc6f3760951fde0ab72cc36bd0cea4d46861e780f45f15fed7451b3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:01:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ff7c1a2c5dc6f3760951fde0ab72cc36bd0cea4d46861e780f45f15fed7451b3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:01:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ff7c1a2c5dc6f3760951fde0ab72cc36bd0cea4d46861e780f45f15fed7451b3","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:01:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ff7c1a2c5dc6f3760951fde0ab72cc36bd0cea4d46861e780f45f15fed7451b3"}
{"level":"debug","ts":"2026-07-12T20:01:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/ff7c1a2c5dc6f3760951fde0ab72cc36bd0cea4d46861e780f45f15fed7451b3","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:01:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ff7c1a2c5dc6f3760951fde0ab72cc36bd0cea4d46861e780f45f15fed7451b3","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:01:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ff7c1a2c5dc6f3760951fde0ab72cc36bd0cea4d46861e780f45f15fed7451b3"}
{"level":"debug","ts":"2026-07-12T20:01:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ff7c1a2c5dc6f3760951fde0ab72cc36bd0cea4d46861e780f45f15fed7451b3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:01:09Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:01:09Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ff7c1a2c5dc6f3760951fde0ab72cc36bd0cea4d46861e780f45f15fed7451b3"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:01:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ff7c1a2c5dc6f3760951fde0ab72cc36bd0cea4d46861e780f45f15fed7451b3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:01:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ff7c1a2c5dc6f3760951fde0ab72cc36bd0cea4d46861e780f45f15fed7451b3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:01:09Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:01:09Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-12T20:01:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/ff7c1a2c5dc6f3760951fde0ab72cc36bd0cea4d46861e780f45f15fed7451b3","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:01:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ff7c1a2c5dc6f3760951fde0ab72cc36bd0cea4d46861e780f45f15fed7451b3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:01:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"52c56b473f7339a043d70af214c965042760391de7e941dfd95cd8b349d302ae","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:01:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ff7c1a2c5dc6f3760951fde0ab72cc36bd0cea4d46861e780f45f15fed7451b3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:01:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ff7c1a2c5dc6f3760951fde0ab72cc36bd0cea4d46861e780f45f15fed7451b3","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:01:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ff7c1a2c5dc6f3760951fde0ab72cc36bd0cea4d46861e780f45f15fed7451b3"}
{"level":"debug","ts":"2026-07-12T20:01:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/52c56b473f7339a043d70af214c965042760391de7e941dfd95cd8b349d302ae","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:01:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ff7c1a2c5dc6f3760951fde0ab72cc36bd0cea4d46861e780f45f15fed7451b3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:01:09Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:01:09Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ff7c1a2c5dc6f3760951fde0ab72cc36bd0cea4d46861e780f45f15fed7451b3"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:01:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/52c56b473f7339a043d70af214c965042760391de7e941dfd95cd8b349d302ae"}
{"level":"info","ts":"2026-07-12T20:01:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ff7c1a2c5dc6f3760951fde0ab72cc36bd0cea4d46861e780f45f15fed7451b3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:01:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/ff7c1a2c5dc6f3760951fde0ab72cc36bd0cea4d46861e780f45f15fed7451b3","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:01:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ff7c1a2c5dc6f3760951fde0ab72cc36bd0cea4d46861e780f45f15fed7451b3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:01:09Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:01:09Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:01:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ff7c1a2c5dc6f3760951fde0ab72cc36bd0cea4d46861e780f45f15fed7451b3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:01:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ff7c1a2c5dc6f3760951fde0ab72cc36bd0cea4d46861e780f45f15fed7451b3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:01:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ff7c1a2c5dc6f3760951fde0ab72cc36bd0cea4d46861e780f45f15fed7451b3","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:01:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ff7c1a2c5dc6f3760951fde0ab72cc36bd0cea4d46861e780f45f15fed7451b3"}
{"level":"debug","ts":"2026-07-12T20:01:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/ff7c1a2c5dc6f3760951fde0ab72cc36bd0cea4d46861e780f45f15fed7451b3","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:01:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ff7c1a2c5dc6f3760951fde0ab72cc36bd0cea4d46861e780f45f15fed7451b3","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:01:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ff7c1a2c5dc6f3760951fde0ab72cc36bd0cea4d46861e780f45f15fed7451b3"}
{"level":"debug","ts":"2026-07-12T20:01:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ff7c1a2c5dc6f3760951fde0ab72cc36bd0cea4d46861e780f45f15fed7451b3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:01:09Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:01:09Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ff7c1a2c5dc6f3760951fde0ab72cc36bd0cea4d46861e780f45f15fed7451b3"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:01:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ff7c1a2c5dc6f3760951fde0ab72cc36bd0cea4d46861e780f45f15fed7451b3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:01:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ff7c1a2c5dc6f3760951fde0ab72cc36bd0cea4d46861e780f45f15fed7451b3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:01:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/ff7c1a2c5dc6f3760951fde0ab72cc36bd0cea4d46861e780f45f15fed7451b3","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:01:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ff7c1a2c5dc6f3760951fde0ab72cc36bd0cea4d46861e780f45f15fed7451b3"}
{"level":"debug","ts":"2026-07-12T20:01:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b8efafc31b6416bc2a9bedf366ecde25c30fa30b41e33922bdcfb8f1a9e8be15","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:01:09Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:01:09Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-12T20:01:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/b8efafc31b6416bc2a9bedf366ecde25c30fa30b41e33922bdcfb8f1a9e8be15","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:01:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b8efafc31b6416bc2a9bedf366ecde25c30fa30b41e33922bdcfb8f1a9e8be15","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:01:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b8efafc31b6416bc2a9bedf366ecde25c30fa30b41e33922bdcfb8f1a9e8be15","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:01:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b8efafc31b6416bc2a9bedf366ecde25c30fa30b41e33922bdcfb8f1a9e8be15","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:01:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b8efafc31b6416bc2a9bedf366ecde25c30fa30b41e33922bdcfb8f1a9e8be15"}
{"level":"debug","ts":"2026-07-12T20:01:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/b8efafc31b6416bc2a9bedf366ecde25c30fa30b41e33922bdcfb8f1a9e8be15","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:01:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b8efafc31b6416bc2a9bedf366ecde25c30fa30b41e33922bdcfb8f1a9e8be15","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:01:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b8efafc31b6416bc2a9bedf366ecde25c30fa30b41e33922bdcfb8f1a9e8be15"}
{"level":"debug","ts":"2026-07-12T20:01:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b8efafc31b6416bc2a9bedf366ecde25c30fa30b41e33922bdcfb8f1a9e8be15","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:01:09Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:01:09Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b8efafc31b6416bc2a9bedf366ecde25c30fa30b41e33922bdcfb8f1a9e8be15"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:01:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b8efafc31b6416bc2a9bedf366ecde25c30fa30b41e33922bdcfb8f1a9e8be15","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:01:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b8efafc31b6416bc2a9bedf366ecde25c30fa30b41e33922bdcfb8f1a9e8be15","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:01:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/b8efafc31b6416bc2a9bedf366ecde25c30fa30b41e33922bdcfb8f1a9e8be15","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:01:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"31ed2d8157851e97846b7ec73dc83fb3e20341f09d31847bfbfd47ba50d0e04b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:01:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b8efafc31b6416bc2a9bedf366ecde25c30fa30b41e33922bdcfb8f1a9e8be15"}
{"level":"debug","ts":"2026-07-12T20:01:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/31ed2d8157851e97846b7ec73dc83fb3e20341f09d31847bfbfd47ba50d0e04b","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:01:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/31ed2d8157851e97846b7ec73dc83fb3e20341f09d31847bfbfd47ba50d0e04b"}
{"level":"debug","ts":"2026-07-12T20:01:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ee6fe41741d318ef9a23db979185da67e66f4ff7b4ced5159dd8a35df3c98c27","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:01:09Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:01:09Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-12T20:01:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/ee6fe41741d318ef9a23db979185da67e66f4ff7b4ced5159dd8a35df3c98c27","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:01:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ee6fe41741d318ef9a23db979185da67e66f4ff7b4ced5159dd8a35df3c98c27","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:01:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a466ea25b3033d9ee28f4cb22fa9687019733c4bf419530122aa217f81025d50","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:01:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ee6fe41741d318ef9a23db979185da67e66f4ff7b4ced5159dd8a35df3c98c27","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:01:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ee6fe41741d318ef9a23db979185da67e66f4ff7b4ced5159dd8a35df3c98c27","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:01:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ee6fe41741d318ef9a23db979185da67e66f4ff7b4ced5159dd8a35df3c98c27"}
{"level":"debug","ts":"2026-07-12T20:01:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/a466ea25b3033d9ee28f4cb22fa9687019733c4bf419530122aa217f81025d50","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:01:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ee6fe41741d318ef9a23db979185da67e66f4ff7b4ced5159dd8a35df3c98c27","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:01:09Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:01:09Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ee6fe41741d318ef9a23db979185da67e66f4ff7b4ced5159dd8a35df3c98c27"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:01:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a466ea25b3033d9ee28f4cb22fa9687019733c4bf419530122aa217f81025d50"}
{"level":"debug","ts":"2026-07-12T20:01:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/ee6fe41741d318ef9a23db979185da67e66f4ff7b4ced5159dd8a35df3c98c27","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:01:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ee6fe41741d318ef9a23db979185da67e66f4ff7b4ced5159dd8a35df3c98c27","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:01:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ee6fe41741d318ef9a23db979185da67e66f4ff7b4ced5159dd8a35df3c98c27","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:01:09Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:01:09Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:01:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ee6fe41741d318ef9a23db979185da67e66f4ff7b4ced5159dd8a35df3c98c27","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:01:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ee6fe41741d318ef9a23db979185da67e66f4ff7b4ced5159dd8a35df3c98c27","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:01:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ee6fe41741d318ef9a23db979185da67e66f4ff7b4ced5159dd8a35df3c98c27","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:01:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ee6fe41741d318ef9a23db979185da67e66f4ff7b4ced5159dd8a35df3c98c27"}
{"level":"debug","ts":"2026-07-12T20:01:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/ee6fe41741d318ef9a23db979185da67e66f4ff7b4ced5159dd8a35df3c98c27","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:01:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ee6fe41741d318ef9a23db979185da67e66f4ff7b4ced5159dd8a35df3c98c27","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:01:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ee6fe41741d318ef9a23db979185da67e66f4ff7b4ced5159dd8a35df3c98c27"}
{"level":"debug","ts":"2026-07-12T20:01:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"691e13fbb6114fee2b0ecccd3882720303e0264726c7673d733011fb644847d2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:01:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/691e13fbb6114fee2b0ecccd3882720303e0264726c7673d733011fb644847d2","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:01:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e7414a0af14752915aff762b99a3b907fa0d83e6d971480783a04dce9faef697","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:01:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/691e13fbb6114fee2b0ecccd3882720303e0264726c7673d733011fb644847d2"}
{"level":"debug","ts":"2026-07-12T20:01:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ee6fe41741d318ef9a23db979185da67e66f4ff7b4ced5159dd8a35df3c98c27","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:01:09Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:01:09Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ee6fe41741d318ef9a23db979185da67e66f4ff7b4ced5159dd8a35df3c98c27"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-12T20:01:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/e7414a0af14752915aff762b99a3b907fa0d83e6d971480783a04dce9faef697","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:01:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ee6fe41741d318ef9a23db979185da67e66f4ff7b4ced5159dd8a35df3c98c27","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:01:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ee6fe41741d318ef9a23db979185da67e66f4ff7b4ced5159dd8a35df3c98c27","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:01:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e7414a0af14752915aff762b99a3b907fa0d83e6d971480783a04dce9faef697"}
{"level":"debug","ts":"2026-07-12T20:01:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/ee6fe41741d318ef9a23db979185da67e66f4ff7b4ced5159dd8a35df3c98c27","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:01:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ee6fe41741d318ef9a23db979185da67e66f4ff7b4ced5159dd8a35df3c98c27"}
{"level":"debug","ts":"2026-07-12T20:01:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"86d7031d507d6d31ee8bd9bdcfe4da1ec7d3ef91ae9fcfea8ed412594eae9e2b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:01:10Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:01:10Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-12T20:01:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/86d7031d507d6d31ee8bd9bdcfe4da1ec7d3ef91ae9fcfea8ed412594eae9e2b","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:01:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/86d7031d507d6d31ee8bd9bdcfe4da1ec7d3ef91ae9fcfea8ed412594eae9e2b"}
{"level":"info","ts":"2026-07-12T20:01:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"86d7031d507d6d31ee8bd9bdcfe4da1ec7d3ef91ae9fcfea8ed412594eae9e2b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:01:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"86d7031d507d6d31ee8bd9bdcfe4da1ec7d3ef91ae9fcfea8ed412594eae9e2b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:01:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/86d7031d507d6d31ee8bd9bdcfe4da1ec7d3ef91ae9fcfea8ed412594eae9e2b","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:01:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"86d7031d507d6d31ee8bd9bdcfe4da1ec7d3ef91ae9fcfea8ed412594eae9e2b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:01:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"86d7031d507d6d31ee8bd9bdcfe4da1ec7d3ef91ae9fcfea8ed412594eae9e2b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:01:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/86d7031d507d6d31ee8bd9bdcfe4da1ec7d3ef91ae9fcfea8ed412594eae9e2b"}
{"level":"debug","ts":"2026-07-12T20:01:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"86d7031d507d6d31ee8bd9bdcfe4da1ec7d3ef91ae9fcfea8ed412594eae9e2b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:01:10Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:01:10Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["86d7031d507d6d31ee8bd9bdcfe4da1ec7d3ef91ae9fcfea8ed412594eae9e2b"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-12T20:01:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/70eb068fea86146a1e3742f7293176d195c62f0e9e8da8e3c9f0490c7b0d101e","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:01:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"86d7031d507d6d31ee8bd9bdcfe4da1ec7d3ef91ae9fcfea8ed412594eae9e2b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:01:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"70eb068fea86146a1e3742f7293176d195c62f0e9e8da8e3c9f0490c7b0d101e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:01:10Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:01:10Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:01:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/70eb068fea86146a1e3742f7293176d195c62f0e9e8da8e3c9f0490c7b0d101e"}
{"level":"debug","ts":"2026-07-12T20:01:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/86d7031d507d6d31ee8bd9bdcfe4da1ec7d3ef91ae9fcfea8ed412594eae9e2b","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:01:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"70eb068fea86146a1e3742f7293176d195c62f0e9e8da8e3c9f0490c7b0d101e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:01:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"86d7031d507d6d31ee8bd9bdcfe4da1ec7d3ef91ae9fcfea8ed412594eae9e2b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:01:10Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:01:10Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:01:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"86d7031d507d6d31ee8bd9bdcfe4da1ec7d3ef91ae9fcfea8ed412594eae9e2b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:01:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"824c9c2065ef62bcb2992bfd845c90bf44eba7c233de3fef8c36b4326a53e736","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:01:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"70eb068fea86146a1e3742f7293176d195c62f0e9e8da8e3c9f0490c7b0d101e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:01:10Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:01:10Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["70eb068fea86146a1e3742f7293176d195c62f0e9e8da8e3c9f0490c7b0d101e"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:01:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/86d7031d507d6d31ee8bd9bdcfe4da1ec7d3ef91ae9fcfea8ed412594eae9e2b"}
{"level":"debug","ts":"2026-07-12T20:01:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/824c9c2065ef62bcb2992bfd845c90bf44eba7c233de3fef8c36b4326a53e736","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:01:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"70eb068fea86146a1e3742f7293176d195c62f0e9e8da8e3c9f0490c7b0d101e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:01:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"86d7031d507d6d31ee8bd9bdcfe4da1ec7d3ef91ae9fcfea8ed412594eae9e2b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:01:10Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:01:10Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["86d7031d507d6d31ee8bd9bdcfe4da1ec7d3ef91ae9fcfea8ed412594eae9e2b"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:01:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"86d7031d507d6d31ee8bd9bdcfe4da1ec7d3ef91ae9fcfea8ed412594eae9e2b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:01:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"70eb068fea86146a1e3742f7293176d195c62f0e9e8da8e3c9f0490c7b0d101e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:01:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/824c9c2065ef62bcb2992bfd845c90bf44eba7c233de3fef8c36b4326a53e736"}
{"level":"debug","ts":"2026-07-12T20:01:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"86d7031d507d6d31ee8bd9bdcfe4da1ec7d3ef91ae9fcfea8ed412594eae9e2b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:01:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/70eb068fea86146a1e3742f7293176d195c62f0e9e8da8e3c9f0490c7b0d101e","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:01:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"bce9b44b62576b5e34c1006e3fd5f8bd3d106511c772a6dba163d22f683d8f8c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:01:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"31743c49ad9adc66aaa61cf2532157588601e99688a1987c3e96852a413ce2a5","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:01:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/70eb068fea86146a1e3742f7293176d195c62f0e9e8da8e3c9f0490c7b0d101e"}
{"level":"debug","ts":"2026-07-12T20:01:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/86d7031d507d6d31ee8bd9bdcfe4da1ec7d3ef91ae9fcfea8ed412594eae9e2b","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:01:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3457cbea8279a3e53f1ed121353b49f6f8875108ae6e78b1d0a953332af06d8f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:01:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/86d7031d507d6d31ee8bd9bdcfe4da1ec7d3ef91ae9fcfea8ed412594eae9e2b"}
{"level":"debug","ts":"2026-07-12T20:01:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4c00f298f9197cfe1b0ccafae219eae9ca99cf8a4838542b4a1620760b1bbea3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:01:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/bce9b44b62576b5e34c1006e3fd5f8bd3d106511c772a6dba163d22f683d8f8c","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:01:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bce9b44b62576b5e34c1006e3fd5f8bd3d106511c772a6dba163d22f683d8f8c"}
{"level":"debug","ts":"2026-07-12T20:01:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/31743c49ad9adc66aaa61cf2532157588601e99688a1987c3e96852a413ce2a5","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:01:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/31743c49ad9adc66aaa61cf2532157588601e99688a1987c3e96852a413ce2a5"}
{"level":"debug","ts":"2026-07-12T20:01:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/3457cbea8279a3e53f1ed121353b49f6f8875108ae6e78b1d0a953332af06d8f","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:01:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8589e34592f19f4e51845be1f42094866a764af48316124682f6ce3341e75651","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:01:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2e88668e949b20e17646ca2ec685317a90fcd3921811f5ac2e99cf5f3ab1d12d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:01:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3457cbea8279a3e53f1ed121353b49f6f8875108ae6e78b1d0a953332af06d8f"}
{"level":"debug","ts":"2026-07-12T20:01:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4c00f298f9197cfe1b0ccafae219eae9ca99cf8a4838542b4a1620760b1bbea3","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:01:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c09b55b1f90fb3d7000f8402aa12528c517b8c63ddea45ee7685f92f8bbcd413","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:01:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4c00f298f9197cfe1b0ccafae219eae9ca99cf8a4838542b4a1620760b1bbea3"}
{"level":"debug","ts":"2026-07-12T20:01:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/8589e34592f19f4e51845be1f42094866a764af48316124682f6ce3341e75651","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:01:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8589e34592f19f4e51845be1f42094866a764af48316124682f6ce3341e75651"}
{"level":"debug","ts":"2026-07-12T20:01:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/2e88668e949b20e17646ca2ec685317a90fcd3921811f5ac2e99cf5f3ab1d12d","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:01:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2e88668e949b20e17646ca2ec685317a90fcd3921811f5ac2e99cf5f3ab1d12d"}
{"level":"debug","ts":"2026-07-12T20:01:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/c09b55b1f90fb3d7000f8402aa12528c517b8c63ddea45ee7685f92f8bbcd413","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:01:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c09b55b1f90fb3d7000f8402aa12528c517b8c63ddea45ee7685f92f8bbcd413"}
{"level":"info","ts":"2026-07-12T20:01:12Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1f9f078e-3457-418f-857c-9bf127d0b6f5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:49588","PortSpecifier":{"PortValue":49588}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.37:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1f9f078e-3457-418f-857c-9bf127d0b6f5","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-e68438.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T20:01:12Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1f9f078e-3457-418f-857c-9bf127d0b6f5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:49588","PortSpecifier":{"PortValue":49588}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.37:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783886472,"nanos":292284447},"http":{"id":"1f9f078e-3457-418f-857c-9bf127d0b6f5","method":"POST","headers":{":authority":"e2e-shared-a-e68438.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T20:01:12Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"1f9f078e-3457-418f-857c-9bf127d0b6f5","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-12T20:01:12Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"1f9f078e-3457-418f-857c-9bf127d0b6f5","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-12T20:01:12Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1f9f078e-3457-418f-857c-9bf127d0b6f5","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"f539f6ce-054a-47a2-a0ef-54f768a351e3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=fc3bc2b6-ad40-4d2c-9c7e-ac1c58cf971d"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/b1708c845c3c"]}}
{"level":"debug","ts":"2026-07-12T20:01:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1f9f078e-3457-418f-857c-9bf127d0b6f5","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/b1708c845c3c"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=fc3bc2b6-ad40-4d2c-9c7e-ac1c58cf971d"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"f539f6ce-054a-47a2-a0ef-54f768a351e3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"ee6fe41741d318ef9a23db979185da67e66f4ff7b4ced5159dd8a35df3c98c27"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.37:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-e68438.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T20:01:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1f9f078e-3457-418f-857c-9bf127d0b6f5","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:01:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1f9f078e-3457-418f-857c-9bf127d0b6f5","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:01:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1f9f078e-3457-418f-857c-9bf127d0b6f5","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e68438/sub-test-model-e68438\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:01:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"1f9f078e-3457-418f-857c-9bf127d0b6f5","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-12T20:01:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1f9f078e-3457-418f-857c-9bf127d0b6f5","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-12T20:01:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1f9f078e-3457-418f-857c-9bf127d0b6f5","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-12T20:01:12Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1f9f078e-3457-418f-857c-9bf127d0b6f5","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T20:01:12Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1f9f078e-3457-418f-857c-9bf127d0b6f5","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T20:01:12Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f9e2c342-ec28-4ec3-9b80-94509fcc16f5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:34484","PortSpecifier":{"PortValue":34484}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.63:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f9e2c342-ec28-4ec3-9b80-94509fcc16f5","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-5865e5.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T20:01:12Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f9e2c342-ec28-4ec3-9b80-94509fcc16f5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:34484","PortSpecifier":{"PortValue":34484}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.63:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783886472,"nanos":337152477},"http":{"id":"f9e2c342-ec28-4ec3-9b80-94509fcc16f5","method":"POST","headers":{":authority":"e2e-shared-b-5865e5.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T20:01:12Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"f9e2c342-ec28-4ec3-9b80-94509fcc16f5","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-12T20:01:12Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"f9e2c342-ec28-4ec3-9b80-94509fcc16f5","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-12T20:01:12Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f9e2c342-ec28-4ec3-9b80-94509fcc16f5","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"f539f6ce-054a-47a2-a0ef-54f768a351e3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=fc3bc2b6-ad40-4d2c-9c7e-ac1c58cf971d"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/b1708c845c3c"]}}
{"level":"debug","ts":"2026-07-12T20:01:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f9e2c342-ec28-4ec3-9b80-94509fcc16f5","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/b1708c845c3c"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=fc3bc2b6-ad40-4d2c-9c7e-ac1c58cf971d"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"f539f6ce-054a-47a2-a0ef-54f768a351e3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b8efafc31b6416bc2a9bedf366ecde25c30fa30b41e33922bdcfb8f1a9e8be15"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.63:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-5865e5.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T20:01:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f9e2c342-ec28-4ec3-9b80-94509fcc16f5","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:01:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f9e2c342-ec28-4ec3-9b80-94509fcc16f5","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:01:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f9e2c342-ec28-4ec3-9b80-94509fcc16f5","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-5865e5/sub-test-model-5865e5\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:01:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"f9e2c342-ec28-4ec3-9b80-94509fcc16f5","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-12T20:01:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f9e2c342-ec28-4ec3-9b80-94509fcc16f5","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-12T20:01:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f9e2c342-ec28-4ec3-9b80-94509fcc16f5","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-12T20:01:12Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f9e2c342-ec28-4ec3-9b80-94509fcc16f5","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T20:01:12Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f9e2c342-ec28-4ec3-9b80-94509fcc16f5","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T20:01:12Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"77ec40a2-a274-4150-bdde-96504af8cfe4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:49592","PortSpecifier":{"PortValue":49592}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.37:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"77ec40a2-a274-4150-bdde-96504af8cfe4","method":"GET","path":"/maas-api/v1/subscriptions","host":"e2e-shared-a-e68438.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T20:01:12Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"77ec40a2-a274-4150-bdde-96504af8cfe4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:49592","PortSpecifier":{"PortValue":49592}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.37:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783886472,"nanos":384820023},"http":{"id":"77ec40a2-a274-4150-bdde-96504af8cfe4","method":"GET","headers":{":authority":"e2e-shared-a-e68438.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/subscriptions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T20:01:12Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"77ec40a2-a274-4150-bdde-96504af8cfe4","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-58AiZjdxRfOhc3jN_xE4ASw04SVGCrXHVHpuoyMv1k93ILM1SwyUvpaNU5Cp"}
{"level":"debug","ts":"2026-07-12T20:01:12Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"77ec40a2-a274-4150-bdde-96504af8cfe4","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-e68438.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-58AiZjdxRfOhc3jN_xE4ASw04SVGCrXHVHpuoyMv1k93ILM1SwyUvpaNU5Cp\"}"}
{"level":"debug","ts":"2026-07-12T20:01:12Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"77ec40a2-a274-4150-bdde-96504af8cfe4","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e68438.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"8456c2d2-35c3-42c4-9a79-2b3828ac6049","keyName":"e2e-sub-iso-f35ade","subscription":"e2e-a-only-d965e0","tenant":"e2e-shared-a-e68438","userId":"8456c2d2-35c3-42c4-9a79-2b3828ac6049","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-12T20:01:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"77ec40a2-a274-4150-bdde-96504af8cfe4","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T20:01:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"77ec40a2-a274-4150-bdde-96504af8cfe4","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:01:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"77ec40a2-a274-4150-bdde-96504af8cfe4","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:01:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"77ec40a2-a274-4150-bdde-96504af8cfe4","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e68438/sub-test-model-e68438\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:01:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"77ec40a2-a274-4150-bdde-96504af8cfe4","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-a-only-d965e0"}
{"level":"debug","ts":"2026-07-12T20:01:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"77ec40a2-a274-4150-bdde-96504af8cfe4","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T20:01:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"77ec40a2-a274-4150-bdde-96504af8cfe4","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-12T20:01:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"77ec40a2-a274-4150-bdde-96504af8cfe4","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-12T20:01:12Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"77ec40a2-a274-4150-bdde-96504af8cfe4","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T20:01:12Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"77ec40a2-a274-4150-bdde-96504af8cfe4","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T20:01:12Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cb643de9-d722-4d6e-b218-ee3049ec24d2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:34494","PortSpecifier":{"PortValue":34494}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.63:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"cb643de9-d722-4d6e-b218-ee3049ec24d2","method":"GET","path":"/maas-api/v1/subscriptions","host":"e2e-shared-b-5865e5.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T20:01:12Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cb643de9-d722-4d6e-b218-ee3049ec24d2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:34494","PortSpecifier":{"PortValue":34494}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.63:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783886472,"nanos":415268012},"http":{"id":"cb643de9-d722-4d6e-b218-ee3049ec24d2","method":"GET","headers":{":authority":"e2e-shared-b-5865e5.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/subscriptions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T20:01:12Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"cb643de9-d722-4d6e-b218-ee3049ec24d2","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-JanfDSSXnc5z4bAH_66qa3T2KPAgcn60jim0IRj7flFsVtj5w8sc6kpKq7uk"}
{"level":"debug","ts":"2026-07-12T20:01:12Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"cb643de9-d722-4d6e-b218-ee3049ec24d2","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-5865e5.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-JanfDSSXnc5z4bAH_66qa3T2KPAgcn60jim0IRj7flFsVtj5w8sc6kpKq7uk\"}"}
{"level":"debug","ts":"2026-07-12T20:01:12Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"cb643de9-d722-4d6e-b218-ee3049ec24d2","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-5865e5.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"66f9e23b-c545-4ff6-b9b2-df324f155043","keyName":"e2e-sub-iso-1f5db0","subscription":"e2e-b-only-d965e0","tenant":"e2e-shared-b-5865e5","userId":"66f9e23b-c545-4ff6-b9b2-df324f155043","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-12T20:01:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"cb643de9-d722-4d6e-b218-ee3049ec24d2","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T20:01:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cb643de9-d722-4d6e-b218-ee3049ec24d2","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:01:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cb643de9-d722-4d6e-b218-ee3049ec24d2","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:01:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cb643de9-d722-4d6e-b218-ee3049ec24d2","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-5865e5/sub-test-model-5865e5\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:01:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cb643de9-d722-4d6e-b218-ee3049ec24d2","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-b-only-d965e0"}
{"level":"debug","ts":"2026-07-12T20:01:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cb643de9-d722-4d6e-b218-ee3049ec24d2","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-12T20:01:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cb643de9-d722-4d6e-b218-ee3049ec24d2","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-12T20:01:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"cb643de9-d722-4d6e-b218-ee3049ec24d2","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-12T20:01:12Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cb643de9-d722-4d6e-b218-ee3049ec24d2","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T20:01:12Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cb643de9-d722-4d6e-b218-ee3049ec24d2","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T20:01:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e4a8736d-7825-4f38-be87-015a00a98804","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:47040","PortSpecifier":{"PortValue":47040}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.37:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e4a8736d-7825-4f38-be87-015a00a98804","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-e68438.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T20:01:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e4a8736d-7825-4f38-be87-015a00a98804","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:47040","PortSpecifier":{"PortValue":47040}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.37:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783886482,"nanos":263537017},"http":{"id":"e4a8736d-7825-4f38-be87-015a00a98804","method":"POST","headers":{":authority":"e2e-shared-a-e68438.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T20:01:22Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"e4a8736d-7825-4f38-be87-015a00a98804","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-12T20:01:22Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"e4a8736d-7825-4f38-be87-015a00a98804","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-12T20:01:22Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e4a8736d-7825-4f38-be87-015a00a98804","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"f539f6ce-054a-47a2-a0ef-54f768a351e3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=fc3bc2b6-ad40-4d2c-9c7e-ac1c58cf971d"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/b1708c845c3c"]}}
{"level":"debug","ts":"2026-07-12T20:01:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e4a8736d-7825-4f38-be87-015a00a98804","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/b1708c845c3c"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=fc3bc2b6-ad40-4d2c-9c7e-ac1c58cf971d"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"f539f6ce-054a-47a2-a0ef-54f768a351e3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"ee6fe41741d318ef9a23db979185da67e66f4ff7b4ced5159dd8a35df3c98c27"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.37:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-e68438.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T20:01:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e4a8736d-7825-4f38-be87-015a00a98804","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:01:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e4a8736d-7825-4f38-be87-015a00a98804","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:01:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e4a8736d-7825-4f38-be87-015a00a98804","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e68438/sub-test-model-e68438\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:01:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"e4a8736d-7825-4f38-be87-015a00a98804","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-12T20:01:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e4a8736d-7825-4f38-be87-015a00a98804","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-12T20:01:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e4a8736d-7825-4f38-be87-015a00a98804","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-12T20:01:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e4a8736d-7825-4f38-be87-015a00a98804","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T20:01:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e4a8736d-7825-4f38-be87-015a00a98804","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T20:01:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3aed0309-23fe-489a-8a22-ebf265dcc914","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:41722","PortSpecifier":{"PortValue":41722}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.63:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3aed0309-23fe-489a-8a22-ebf265dcc914","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-5865e5.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T20:01:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3aed0309-23fe-489a-8a22-ebf265dcc914","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:41722","PortSpecifier":{"PortValue":41722}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.63:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783886482,"nanos":303237466},"http":{"id":"3aed0309-23fe-489a-8a22-ebf265dcc914","method":"POST","headers":{":authority":"e2e-shared-b-5865e5.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T20:01:22Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"3aed0309-23fe-489a-8a22-ebf265dcc914","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-12T20:01:22Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"3aed0309-23fe-489a-8a22-ebf265dcc914","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-12T20:01:22Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3aed0309-23fe-489a-8a22-ebf265dcc914","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"f539f6ce-054a-47a2-a0ef-54f768a351e3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=fc3bc2b6-ad40-4d2c-9c7e-ac1c58cf971d"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/b1708c845c3c"]}}
{"level":"debug","ts":"2026-07-12T20:01:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3aed0309-23fe-489a-8a22-ebf265dcc914","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/b1708c845c3c"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=fc3bc2b6-ad40-4d2c-9c7e-ac1c58cf971d"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"f539f6ce-054a-47a2-a0ef-54f768a351e3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b8efafc31b6416bc2a9bedf366ecde25c30fa30b41e33922bdcfb8f1a9e8be15"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.63:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-5865e5.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T20:01:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3aed0309-23fe-489a-8a22-ebf265dcc914","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:01:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3aed0309-23fe-489a-8a22-ebf265dcc914","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:01:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3aed0309-23fe-489a-8a22-ebf265dcc914","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-5865e5/sub-test-model-5865e5\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:01:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"3aed0309-23fe-489a-8a22-ebf265dcc914","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-12T20:01:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3aed0309-23fe-489a-8a22-ebf265dcc914","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-12T20:01:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3aed0309-23fe-489a-8a22-ebf265dcc914","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-12T20:01:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3aed0309-23fe-489a-8a22-ebf265dcc914","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T20:01:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3aed0309-23fe-489a-8a22-ebf265dcc914","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T20:01:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"bf3a784c-3ce9-48d0-8ee4-1901a8527e04","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:47044","PortSpecifier":{"PortValue":47044}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.37:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"bf3a784c-3ce9-48d0-8ee4-1901a8527e04","method":"POST","path":"/maas-api/internal/v1/subscriptions/select","host":"e2e-shared-a-e68438.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T20:01:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"bf3a784c-3ce9-48d0-8ee4-1901a8527e04","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:47044","PortSpecifier":{"PortValue":47044}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.37:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783886482,"nanos":344442155},"http":{"id":"bf3a784c-3ce9-48d0-8ee4-1901a8527e04","method":"POST","headers":{":authority":"e2e-shared-a-e68438.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/internal/v1/subscriptions/select",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T20:01:22Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"bf3a784c-3ce9-48d0-8ee4-1901a8527e04","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-MEpC33RkJgo4ETCe_YKFMFG3S5i4QuQBrjWFOvUlLks62ndH1hmUGqlVWFAK"}
{"level":"debug","ts":"2026-07-12T20:01:22Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"bf3a784c-3ce9-48d0-8ee4-1901a8527e04","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-e68438.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-MEpC33RkJgo4ETCe_YKFMFG3S5i4QuQBrjWFOvUlLks62ndH1hmUGqlVWFAK\"}"}
{"level":"debug","ts":"2026-07-12T20:01:22Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"bf3a784c-3ce9-48d0-8ee4-1901a8527e04","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e68438.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"81516845-0d8d-443a-b79c-a0d197811af7","keyName":"e2e-sub-iso-635c08","subscription":"e2e-shared-sub-53dbba","tenant":"e2e-shared-a-e68438","userId":"81516845-0d8d-443a-b79c-a0d197811af7","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-12T20:01:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"bf3a784c-3ce9-48d0-8ee4-1901a8527e04","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T20:01:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bf3a784c-3ce9-48d0-8ee4-1901a8527e04","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:01:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bf3a784c-3ce9-48d0-8ee4-1901a8527e04","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:01:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bf3a784c-3ce9-48d0-8ee4-1901a8527e04","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e68438/sub-test-model-e68438\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:01:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bf3a784c-3ce9-48d0-8ee4-1901a8527e04","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-12T20:01:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"bf3a784c-3ce9-48d0-8ee4-1901a8527e04","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T20:01:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bf3a784c-3ce9-48d0-8ee4-1901a8527e04","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-shared-sub-53dbba"}
{"level":"debug","ts":"2026-07-12T20:01:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bf3a784c-3ce9-48d0-8ee4-1901a8527e04","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-12T20:01:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"bf3a784c-3ce9-48d0-8ee4-1901a8527e04","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T20:01:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"bf3a784c-3ce9-48d0-8ee4-1901a8527e04","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T20:01:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b92695e7-18ae-46eb-a6a6-879fb7bbdd82","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:41732","PortSpecifier":{"PortValue":41732}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.63:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b92695e7-18ae-46eb-a6a6-879fb7bbdd82","method":"POST","path":"/maas-api/internal/v1/subscriptions/select","host":"e2e-shared-b-5865e5.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T20:01:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b92695e7-18ae-46eb-a6a6-879fb7bbdd82","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:41732","PortSpecifier":{"PortValue":41732}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.63:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783886482,"nanos":379622571},"http":{"id":"b92695e7-18ae-46eb-a6a6-879fb7bbdd82","method":"POST","headers":{":authority":"e2e-shared-b-5865e5.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/internal/v1/subscriptions/select",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T20:01:22Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b92695e7-18ae-46eb-a6a6-879fb7bbdd82","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-ECNNZUTn7eSkKO4u_cCZwcLpB58CwN249os8W1iO2SNJx2222nuDosM0Semo"}
{"level":"debug","ts":"2026-07-12T20:01:22Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b92695e7-18ae-46eb-a6a6-879fb7bbdd82","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-5865e5.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-ECNNZUTn7eSkKO4u_cCZwcLpB58CwN249os8W1iO2SNJx2222nuDosM0Semo\"}"}
{"level":"debug","ts":"2026-07-12T20:01:22Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b92695e7-18ae-46eb-a6a6-879fb7bbdd82","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-5865e5.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"325c0ae0-9637-435a-921c-bdc279f33d84","keyName":"e2e-sub-iso-2f6d45","subscription":"e2e-shared-sub-53dbba","tenant":"e2e-shared-b-5865e5","userId":"325c0ae0-9637-435a-921c-bdc279f33d84","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-12T20:01:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b92695e7-18ae-46eb-a6a6-879fb7bbdd82","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T20:01:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b92695e7-18ae-46eb-a6a6-879fb7bbdd82","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:01:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b92695e7-18ae-46eb-a6a6-879fb7bbdd82","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:01:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b92695e7-18ae-46eb-a6a6-879fb7bbdd82","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-5865e5/sub-test-model-5865e5\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:01:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b92695e7-18ae-46eb-a6a6-879fb7bbdd82","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-12T20:01:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b92695e7-18ae-46eb-a6a6-879fb7bbdd82","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-12T20:01:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b92695e7-18ae-46eb-a6a6-879fb7bbdd82","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-shared-sub-53dbba"}
{"level":"debug","ts":"2026-07-12T20:01:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"b92695e7-18ae-46eb-a6a6-879fb7bbdd82","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-12T20:01:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b92695e7-18ae-46eb-a6a6-879fb7bbdd82","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T20:01:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b92695e7-18ae-46eb-a6a6-879fb7bbdd82","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T20:01:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/70eb068fea86146a1e3742f7293176d195c62f0e9e8da8e3c9f0490c7b0d101e"}
{"level":"info","ts":"2026-07-12T20:01:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ff7c1a2c5dc6f3760951fde0ab72cc36bd0cea4d46861e780f45f15fed7451b3"}
{"level":"info","ts":"2026-07-12T20:01:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3457cbea8279a3e53f1ed121353b49f6f8875108ae6e78b1d0a953332af06d8f"}
{"level":"info","ts":"2026-07-12T20:01:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a466ea25b3033d9ee28f4cb22fa9687019733c4bf419530122aa217f81025d50"}
{"level":"info","ts":"2026-07-12T20:01:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/319046e4aa8326c67f39ed2db84403086e858f5e9fc752e72b1544bd3de1ab07"}
{"level":"info","ts":"2026-07-12T20:01:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/31ed2d8157851e97846b7ec73dc83fb3e20341f09d31847bfbfd47ba50d0e04b"}
{"level":"info","ts":"2026-07-12T20:01:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/824c9c2065ef62bcb2992bfd845c90bf44eba7c233de3fef8c36b4326a53e736"}
{"level":"info","ts":"2026-07-12T20:01:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/8589e34592f19f4e51845be1f42094866a764af48316124682f6ce3341e75651"}
{"level":"info","ts":"2026-07-12T20:01:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/52c56b473f7339a043d70af214c965042760391de7e941dfd95cd8b349d302ae"}
{"level":"info","ts":"2026-07-12T20:01:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2e88668e949b20e17646ca2ec685317a90fcd3921811f5ac2e99cf5f3ab1d12d"}
{"level":"info","ts":"2026-07-12T20:01:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e7414a0af14752915aff762b99a3b907fa0d83e6d971480783a04dce9faef697"}
{"level":"info","ts":"2026-07-12T20:01:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/691e13fbb6114fee2b0ecccd3882720303e0264726c7673d733011fb644847d2"}
{"level":"info","ts":"2026-07-12T20:01:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/31743c49ad9adc66aaa61cf2532157588601e99688a1987c3e96852a413ce2a5"}
{"level":"info","ts":"2026-07-12T20:01:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/926aa4279f89deb74202d57b5dc0403904fbba9c530afe4129683cbc9b7c7852"}
{"level":"info","ts":"2026-07-12T20:01:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c09b55b1f90fb3d7000f8402aa12528c517b8c63ddea45ee7685f92f8bbcd413"}
{"level":"info","ts":"2026-07-12T20:01:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/bce9b44b62576b5e34c1006e3fd5f8bd3d106511c772a6dba163d22f683d8f8c"}
{"level":"debug","ts":"2026-07-12T20:01:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dfb3b6da41117eca2f16fc173ddbb334b86f2c8ec4d91585fe9473dc2dd3ed03","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:01:42Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:01:42Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-12T20:01:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/dfb3b6da41117eca2f16fc173ddbb334b86f2c8ec4d91585fe9473dc2dd3ed03","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:01:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dfb3b6da41117eca2f16fc173ddbb334b86f2c8ec4d91585fe9473dc2dd3ed03","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:01:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dfb3b6da41117eca2f16fc173ddbb334b86f2c8ec4d91585fe9473dc2dd3ed03","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:01:42Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:01:42Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:01:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dfb3b6da41117eca2f16fc173ddbb334b86f2c8ec4d91585fe9473dc2dd3ed03","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:01:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dfb3b6da41117eca2f16fc173ddbb334b86f2c8ec4d91585fe9473dc2dd3ed03","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:01:42Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:01:42Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:01:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dfb3b6da41117eca2f16fc173ddbb334b86f2c8ec4d91585fe9473dc2dd3ed03"}
{"level":"error","ts":"2026-07-12T20:01:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"dfb3b6da41117eca2f16fc173ddbb334b86f2c8ec4d91585fe9473dc2dd3ed03","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"dfb3b6da41117eca2f16fc173ddbb334b86f2c8ec4d91585fe9473dc2dd3ed03\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-12T20:01:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dfb3b6da41117eca2f16fc173ddbb334b86f2c8ec4d91585fe9473dc2dd3ed03","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:01:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/dfb3b6da41117eca2f16fc173ddbb334b86f2c8ec4d91585fe9473dc2dd3ed03","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:01:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dfb3b6da41117eca2f16fc173ddbb334b86f2c8ec4d91585fe9473dc2dd3ed03","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:01:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dfb3b6da41117eca2f16fc173ddbb334b86f2c8ec4d91585fe9473dc2dd3ed03"}
{"level":"debug","ts":"2026-07-12T20:01:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dfb3b6da41117eca2f16fc173ddbb334b86f2c8ec4d91585fe9473dc2dd3ed03","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:01:42Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:01:42Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["dfb3b6da41117eca2f16fc173ddbb334b86f2c8ec4d91585fe9473dc2dd3ed03"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:01:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dfb3b6da41117eca2f16fc173ddbb334b86f2c8ec4d91585fe9473dc2dd3ed03","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:01:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dfb3b6da41117eca2f16fc173ddbb334b86f2c8ec4d91585fe9473dc2dd3ed03","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:01:42Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:01:42Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-12T20:01:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/dfb3b6da41117eca2f16fc173ddbb334b86f2c8ec4d91585fe9473dc2dd3ed03","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:01:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dfb3b6da41117eca2f16fc173ddbb334b86f2c8ec4d91585fe9473dc2dd3ed03","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:01:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dfb3b6da41117eca2f16fc173ddbb334b86f2c8ec4d91585fe9473dc2dd3ed03","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:01:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dfb3b6da41117eca2f16fc173ddbb334b86f2c8ec4d91585fe9473dc2dd3ed03","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:01:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dfb3b6da41117eca2f16fc173ddbb334b86f2c8ec4d91585fe9473dc2dd3ed03"}
{"level":"debug","ts":"2026-07-12T20:01:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/dfb3b6da41117eca2f16fc173ddbb334b86f2c8ec4d91585fe9473dc2dd3ed03","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:01:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dfb3b6da41117eca2f16fc173ddbb334b86f2c8ec4d91585fe9473dc2dd3ed03","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:01:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dfb3b6da41117eca2f16fc173ddbb334b86f2c8ec4d91585fe9473dc2dd3ed03"}
{"level":"debug","ts":"2026-07-12T20:01:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dfb3b6da41117eca2f16fc173ddbb334b86f2c8ec4d91585fe9473dc2dd3ed03","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:01:42Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:01:42Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["dfb3b6da41117eca2f16fc173ddbb334b86f2c8ec4d91585fe9473dc2dd3ed03"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:01:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dfb3b6da41117eca2f16fc173ddbb334b86f2c8ec4d91585fe9473dc2dd3ed03","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:01:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dfb3b6da41117eca2f16fc173ddbb334b86f2c8ec4d91585fe9473dc2dd3ed03","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:01:42Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:01:42Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-12T20:01:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/dfb3b6da41117eca2f16fc173ddbb334b86f2c8ec4d91585fe9473dc2dd3ed03","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:01:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dfb3b6da41117eca2f16fc173ddbb334b86f2c8ec4d91585fe9473dc2dd3ed03","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:01:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dfb3b6da41117eca2f16fc173ddbb334b86f2c8ec4d91585fe9473dc2dd3ed03","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:01:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dfb3b6da41117eca2f16fc173ddbb334b86f2c8ec4d91585fe9473dc2dd3ed03","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:01:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dfb3b6da41117eca2f16fc173ddbb334b86f2c8ec4d91585fe9473dc2dd3ed03"}
{"level":"debug","ts":"2026-07-12T20:01:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/dfb3b6da41117eca2f16fc173ddbb334b86f2c8ec4d91585fe9473dc2dd3ed03","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:01:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dfb3b6da41117eca2f16fc173ddbb334b86f2c8ec4d91585fe9473dc2dd3ed03","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:01:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dfb3b6da41117eca2f16fc173ddbb334b86f2c8ec4d91585fe9473dc2dd3ed03"}
{"level":"debug","ts":"2026-07-12T20:01:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dfb3b6da41117eca2f16fc173ddbb334b86f2c8ec4d91585fe9473dc2dd3ed03","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:01:43Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:01:43Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["dfb3b6da41117eca2f16fc173ddbb334b86f2c8ec4d91585fe9473dc2dd3ed03"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:01:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dfb3b6da41117eca2f16fc173ddbb334b86f2c8ec4d91585fe9473dc2dd3ed03","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:01:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dfb3b6da41117eca2f16fc173ddbb334b86f2c8ec4d91585fe9473dc2dd3ed03","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:01:43Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:01:43Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-12T20:01:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/dfb3b6da41117eca2f16fc173ddbb334b86f2c8ec4d91585fe9473dc2dd3ed03","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:01:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dfb3b6da41117eca2f16fc173ddbb334b86f2c8ec4d91585fe9473dc2dd3ed03","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:01:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dfb3b6da41117eca2f16fc173ddbb334b86f2c8ec4d91585fe9473dc2dd3ed03","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:01:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dfb3b6da41117eca2f16fc173ddbb334b86f2c8ec4d91585fe9473dc2dd3ed03","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:01:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dfb3b6da41117eca2f16fc173ddbb334b86f2c8ec4d91585fe9473dc2dd3ed03"}
{"level":"debug","ts":"2026-07-12T20:01:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/dfb3b6da41117eca2f16fc173ddbb334b86f2c8ec4d91585fe9473dc2dd3ed03","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:01:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dfb3b6da41117eca2f16fc173ddbb334b86f2c8ec4d91585fe9473dc2dd3ed03","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:01:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dfb3b6da41117eca2f16fc173ddbb334b86f2c8ec4d91585fe9473dc2dd3ed03"}
{"level":"debug","ts":"2026-07-12T20:01:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dfb3b6da41117eca2f16fc173ddbb334b86f2c8ec4d91585fe9473dc2dd3ed03","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:01:43Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:01:43Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["dfb3b6da41117eca2f16fc173ddbb334b86f2c8ec4d91585fe9473dc2dd3ed03"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:01:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dfb3b6da41117eca2f16fc173ddbb334b86f2c8ec4d91585fe9473dc2dd3ed03","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:01:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dfb3b6da41117eca2f16fc173ddbb334b86f2c8ec4d91585fe9473dc2dd3ed03","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:01:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/dfb3b6da41117eca2f16fc173ddbb334b86f2c8ec4d91585fe9473dc2dd3ed03","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:01:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dfb3b6da41117eca2f16fc173ddbb334b86f2c8ec4d91585fe9473dc2dd3ed03"}
{"level":"debug","ts":"2026-07-12T20:01:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"096ebadafe5a6aea8d6dfb3a4dd7299f8068cb7f885de93472daca06ab52d6fc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:01:43Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:01:43Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-12T20:01:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/096ebadafe5a6aea8d6dfb3a4dd7299f8068cb7f885de93472daca06ab52d6fc","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:01:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"096ebadafe5a6aea8d6dfb3a4dd7299f8068cb7f885de93472daca06ab52d6fc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:01:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"096ebadafe5a6aea8d6dfb3a4dd7299f8068cb7f885de93472daca06ab52d6fc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:01:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"096ebadafe5a6aea8d6dfb3a4dd7299f8068cb7f885de93472daca06ab52d6fc","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:01:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/096ebadafe5a6aea8d6dfb3a4dd7299f8068cb7f885de93472daca06ab52d6fc"}
{"level":"debug","ts":"2026-07-12T20:01:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/096ebadafe5a6aea8d6dfb3a4dd7299f8068cb7f885de93472daca06ab52d6fc","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:01:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"096ebadafe5a6aea8d6dfb3a4dd7299f8068cb7f885de93472daca06ab52d6fc","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:01:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/096ebadafe5a6aea8d6dfb3a4dd7299f8068cb7f885de93472daca06ab52d6fc"}
{"level":"debug","ts":"2026-07-12T20:01:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"096ebadafe5a6aea8d6dfb3a4dd7299f8068cb7f885de93472daca06ab52d6fc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:01:43Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:01:43Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["096ebadafe5a6aea8d6dfb3a4dd7299f8068cb7f885de93472daca06ab52d6fc"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:01:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"096ebadafe5a6aea8d6dfb3a4dd7299f8068cb7f885de93472daca06ab52d6fc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:01:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"096ebadafe5a6aea8d6dfb3a4dd7299f8068cb7f885de93472daca06ab52d6fc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:01:43Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:01:43Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-12T20:01:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/096ebadafe5a6aea8d6dfb3a4dd7299f8068cb7f885de93472daca06ab52d6fc","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:01:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"096ebadafe5a6aea8d6dfb3a4dd7299f8068cb7f885de93472daca06ab52d6fc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:01:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"55716d53519a2168a89de10a7c7208d702cd8957aa3c2802e28d04885fb83bdf","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:01:43Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:01:43Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:01:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"55716d53519a2168a89de10a7c7208d702cd8957aa3c2802e28d04885fb83bdf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:01:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"096ebadafe5a6aea8d6dfb3a4dd7299f8068cb7f885de93472daca06ab52d6fc","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:01:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/096ebadafe5a6aea8d6dfb3a4dd7299f8068cb7f885de93472daca06ab52d6fc"}
{"level":"debug","ts":"2026-07-12T20:01:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"55716d53519a2168a89de10a7c7208d702cd8957aa3c2802e28d04885fb83bdf","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:01:43Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:01:43Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-12T20:01:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/55716d53519a2168a89de10a7c7208d702cd8957aa3c2802e28d04885fb83bdf","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:01:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"55716d53519a2168a89de10a7c7208d702cd8957aa3c2802e28d04885fb83bdf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:01:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"096ebadafe5a6aea8d6dfb3a4dd7299f8068cb7f885de93472daca06ab52d6fc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:01:43Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:01:43Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["096ebadafe5a6aea8d6dfb3a4dd7299f8068cb7f885de93472daca06ab52d6fc"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:01:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/55716d53519a2168a89de10a7c7208d702cd8957aa3c2802e28d04885fb83bdf"}
{"level":"info","ts":"2026-07-12T20:01:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"096ebadafe5a6aea8d6dfb3a4dd7299f8068cb7f885de93472daca06ab52d6fc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:01:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"55716d53519a2168a89de10a7c7208d702cd8957aa3c2802e28d04885fb83bdf","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:01:43Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:01:43Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["55716d53519a2168a89de10a7c7208d702cd8957aa3c2802e28d04885fb83bdf"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-12T20:01:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/096ebadafe5a6aea8d6dfb3a4dd7299f8068cb7f885de93472daca06ab52d6fc","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:01:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"55716d53519a2168a89de10a7c7208d702cd8957aa3c2802e28d04885fb83bdf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:01:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"096ebadafe5a6aea8d6dfb3a4dd7299f8068cb7f885de93472daca06ab52d6fc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:01:43Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:01:43Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:01:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/096ebadafe5a6aea8d6dfb3a4dd7299f8068cb7f885de93472daca06ab52d6fc"}
{"level":"info","ts":"2026-07-12T20:01:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"096ebadafe5a6aea8d6dfb3a4dd7299f8068cb7f885de93472daca06ab52d6fc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:01:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"55716d53519a2168a89de10a7c7208d702cd8957aa3c2802e28d04885fb83bdf","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:01:43Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:01:43Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-12T20:01:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/55716d53519a2168a89de10a7c7208d702cd8957aa3c2802e28d04885fb83bdf","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:01:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"55716d53519a2168a89de10a7c7208d702cd8957aa3c2802e28d04885fb83bdf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:01:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"096ebadafe5a6aea8d6dfb3a4dd7299f8068cb7f885de93472daca06ab52d6fc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:01:43Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:01:43Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["096ebadafe5a6aea8d6dfb3a4dd7299f8068cb7f885de93472daca06ab52d6fc"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:01:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/55716d53519a2168a89de10a7c7208d702cd8957aa3c2802e28d04885fb83bdf"}
{"level":"info","ts":"2026-07-12T20:01:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"096ebadafe5a6aea8d6dfb3a4dd7299f8068cb7f885de93472daca06ab52d6fc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:01:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"55716d53519a2168a89de10a7c7208d702cd8957aa3c2802e28d04885fb83bdf","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:01:43Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:01:43Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["55716d53519a2168a89de10a7c7208d702cd8957aa3c2802e28d04885fb83bdf"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-12T20:01:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/096ebadafe5a6aea8d6dfb3a4dd7299f8068cb7f885de93472daca06ab52d6fc","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:01:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"55716d53519a2168a89de10a7c7208d702cd8957aa3c2802e28d04885fb83bdf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:01:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2cd886926c990cc533fc61bcc58d2267e3283668d7b8a084238691cd7893c7be","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:01:43Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:01:43Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:01:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2cd886926c990cc533fc61bcc58d2267e3283668d7b8a084238691cd7893c7be","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:01:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"096ebadafe5a6aea8d6dfb3a4dd7299f8068cb7f885de93472daca06ab52d6fc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:01:43Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:01:43Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:01:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/096ebadafe5a6aea8d6dfb3a4dd7299f8068cb7f885de93472daca06ab52d6fc"}
{"level":"debug","ts":"2026-07-12T20:01:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/2cd886926c990cc533fc61bcc58d2267e3283668d7b8a084238691cd7893c7be","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:01:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"096ebadafe5a6aea8d6dfb3a4dd7299f8068cb7f885de93472daca06ab52d6fc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:01:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"55716d53519a2168a89de10a7c7208d702cd8957aa3c2802e28d04885fb83bdf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:01:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2cd886926c990cc533fc61bcc58d2267e3283668d7b8a084238691cd7893c7be","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:01:43Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:01:43Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:01:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2cd886926c990cc533fc61bcc58d2267e3283668d7b8a084238691cd7893c7be","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:01:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"096ebadafe5a6aea8d6dfb3a4dd7299f8068cb7f885de93472daca06ab52d6fc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:01:43Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:01:43Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["096ebadafe5a6aea8d6dfb3a4dd7299f8068cb7f885de93472daca06ab52d6fc"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:01:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2cd886926c990cc533fc61bcc58d2267e3283668d7b8a084238691cd7893c7be"}
{"level":"debug","ts":"2026-07-12T20:01:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/55716d53519a2168a89de10a7c7208d702cd8957aa3c2802e28d04885fb83bdf","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:01:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"096ebadafe5a6aea8d6dfb3a4dd7299f8068cb7f885de93472daca06ab52d6fc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:01:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2cd886926c990cc533fc61bcc58d2267e3283668d7b8a084238691cd7893c7be","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:01:43Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:01:43Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["2cd886926c990cc533fc61bcc58d2267e3283668d7b8a084238691cd7893c7be"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:01:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2cd886926c990cc533fc61bcc58d2267e3283668d7b8a084238691cd7893c7be","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:01:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"096ebadafe5a6aea8d6dfb3a4dd7299f8068cb7f885de93472daca06ab52d6fc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:01:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2cd886926c990cc533fc61bcc58d2267e3283668d7b8a084238691cd7893c7be","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:01:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/55716d53519a2168a89de10a7c7208d702cd8957aa3c2802e28d04885fb83bdf"}
{"level":"debug","ts":"2026-07-12T20:01:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/096ebadafe5a6aea8d6dfb3a4dd7299f8068cb7f885de93472daca06ab52d6fc","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:01:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/096ebadafe5a6aea8d6dfb3a4dd7299f8068cb7f885de93472daca06ab52d6fc"}
{"level":"debug","ts":"2026-07-12T20:01:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/2cd886926c990cc533fc61bcc58d2267e3283668d7b8a084238691cd7893c7be","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:01:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2cd886926c990cc533fc61bcc58d2267e3283668d7b8a084238691cd7893c7be"}
{"level":"debug","ts":"2026-07-12T20:01:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"bb35e0d4b17b4d5ca1ae4cb730c86731ab4c4e07e02af1c64671f9a8c4c16868","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:01:43Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:01:43Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-12T20:01:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/bb35e0d4b17b4d5ca1ae4cb730c86731ab4c4e07e02af1c64671f9a8c4c16868","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:01:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"bb35e0d4b17b4d5ca1ae4cb730c86731ab4c4e07e02af1c64671f9a8c4c16868","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:01:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"eef171055d3cc90c2e58999aae3c17bae93199ff1cf260d9df31e755cb9a3ff0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:01:43Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:01:43Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:01:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bb35e0d4b17b4d5ca1ae4cb730c86731ab4c4e07e02af1c64671f9a8c4c16868"}
{"level":"info","ts":"2026-07-12T20:01:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"eef171055d3cc90c2e58999aae3c17bae93199ff1cf260d9df31e755cb9a3ff0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:01:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"bb35e0d4b17b4d5ca1ae4cb730c86731ab4c4e07e02af1c64671f9a8c4c16868","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:01:43Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:01:43Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["bb35e0d4b17b4d5ca1ae4cb730c86731ab4c4e07e02af1c64671f9a8c4c16868"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-12T20:01:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/eef171055d3cc90c2e58999aae3c17bae93199ff1cf260d9df31e755cb9a3ff0","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:01:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"bb35e0d4b17b4d5ca1ae4cb730c86731ab4c4e07e02af1c64671f9a8c4c16868","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:01:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"eef171055d3cc90c2e58999aae3c17bae93199ff1cf260d9df31e755cb9a3ff0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:01:43Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:01:43Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:01:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/eef171055d3cc90c2e58999aae3c17bae93199ff1cf260d9df31e755cb9a3ff0"}
{"level":"info","ts":"2026-07-12T20:01:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"eef171055d3cc90c2e58999aae3c17bae93199ff1cf260d9df31e755cb9a3ff0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:01:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"bb35e0d4b17b4d5ca1ae4cb730c86731ab4c4e07e02af1c64671f9a8c4c16868","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:01:43Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:01:43Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-12T20:01:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/bb35e0d4b17b4d5ca1ae4cb730c86731ab4c4e07e02af1c64671f9a8c4c16868","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:01:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"bb35e0d4b17b4d5ca1ae4cb730c86731ab4c4e07e02af1c64671f9a8c4c16868","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:01:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"eef171055d3cc90c2e58999aae3c17bae93199ff1cf260d9df31e755cb9a3ff0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:01:43Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:01:43Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["eef171055d3cc90c2e58999aae3c17bae93199ff1cf260d9df31e755cb9a3ff0"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:01:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bb35e0d4b17b4d5ca1ae4cb730c86731ab4c4e07e02af1c64671f9a8c4c16868"}
{"level":"info","ts":"2026-07-12T20:01:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"eef171055d3cc90c2e58999aae3c17bae93199ff1cf260d9df31e755cb9a3ff0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:01:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"bb35e0d4b17b4d5ca1ae4cb730c86731ab4c4e07e02af1c64671f9a8c4c16868","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:01:44Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:01:44Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["bb35e0d4b17b4d5ca1ae4cb730c86731ab4c4e07e02af1c64671f9a8c4c16868"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-12T20:01:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/eef171055d3cc90c2e58999aae3c17bae93199ff1cf260d9df31e755cb9a3ff0","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:01:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"bb35e0d4b17b4d5ca1ae4cb730c86731ab4c4e07e02af1c64671f9a8c4c16868","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:01:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"eef171055d3cc90c2e58999aae3c17bae93199ff1cf260d9df31e755cb9a3ff0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:01:44Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:01:44Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:01:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/eef171055d3cc90c2e58999aae3c17bae93199ff1cf260d9df31e755cb9a3ff0"}
{"level":"info","ts":"2026-07-12T20:01:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"eef171055d3cc90c2e58999aae3c17bae93199ff1cf260d9df31e755cb9a3ff0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:01:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"bb35e0d4b17b4d5ca1ae4cb730c86731ab4c4e07e02af1c64671f9a8c4c16868","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:01:44Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:01:44Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-12T20:01:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/bb35e0d4b17b4d5ca1ae4cb730c86731ab4c4e07e02af1c64671f9a8c4c16868","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:01:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"bb35e0d4b17b4d5ca1ae4cb730c86731ab4c4e07e02af1c64671f9a8c4c16868","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:01:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b2027e0b5bf7cc35ce10e8ab11c1540c7477a9a03bcf1dcbf76c77452fa6c2b6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:01:44Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:01:44Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:01:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bb35e0d4b17b4d5ca1ae4cb730c86731ab4c4e07e02af1c64671f9a8c4c16868"}
{"level":"info","ts":"2026-07-12T20:01:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b2027e0b5bf7cc35ce10e8ab11c1540c7477a9a03bcf1dcbf76c77452fa6c2b6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:01:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"eef171055d3cc90c2e58999aae3c17bae93199ff1cf260d9df31e755cb9a3ff0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:01:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"bb35e0d4b17b4d5ca1ae4cb730c86731ab4c4e07e02af1c64671f9a8c4c16868","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:01:44Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:01:44Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["bb35e0d4b17b4d5ca1ae4cb730c86731ab4c4e07e02af1c64671f9a8c4c16868"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-12T20:01:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/eef171055d3cc90c2e58999aae3c17bae93199ff1cf260d9df31e755cb9a3ff0","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:01:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"bb35e0d4b17b4d5ca1ae4cb730c86731ab4c4e07e02af1c64671f9a8c4c16868","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:01:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b2027e0b5bf7cc35ce10e8ab11c1540c7477a9a03bcf1dcbf76c77452fa6c2b6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:01:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"eef171055d3cc90c2e58999aae3c17bae93199ff1cf260d9df31e755cb9a3ff0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:01:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"bb35e0d4b17b4d5ca1ae4cb730c86731ab4c4e07e02af1c64671f9a8c4c16868","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:01:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b2027e0b5bf7cc35ce10e8ab11c1540c7477a9a03bcf1dcbf76c77452fa6c2b6","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:01:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/eef171055d3cc90c2e58999aae3c17bae93199ff1cf260d9df31e755cb9a3ff0"}
{"level":"debug","ts":"2026-07-12T20:01:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/b2027e0b5bf7cc35ce10e8ab11c1540c7477a9a03bcf1dcbf76c77452fa6c2b6","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:01:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"eef171055d3cc90c2e58999aae3c17bae93199ff1cf260d9df31e755cb9a3ff0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:01:44Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:01:44Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["eef171055d3cc90c2e58999aae3c17bae93199ff1cf260d9df31e755cb9a3ff0"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:01:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"eef171055d3cc90c2e58999aae3c17bae93199ff1cf260d9df31e755cb9a3ff0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:01:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b2027e0b5bf7cc35ce10e8ab11c1540c7477a9a03bcf1dcbf76c77452fa6c2b6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:01:44Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:01:44Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:01:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b2027e0b5bf7cc35ce10e8ab11c1540c7477a9a03bcf1dcbf76c77452fa6c2b6"}
{"level":"debug","ts":"2026-07-12T20:01:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/bb35e0d4b17b4d5ca1ae4cb730c86731ab4c4e07e02af1c64671f9a8c4c16868","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:01:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b2027e0b5bf7cc35ce10e8ab11c1540c7477a9a03bcf1dcbf76c77452fa6c2b6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:01:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"eef171055d3cc90c2e58999aae3c17bae93199ff1cf260d9df31e755cb9a3ff0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:01:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b2027e0b5bf7cc35ce10e8ab11c1540c7477a9a03bcf1dcbf76c77452fa6c2b6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:01:44Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:01:44Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b2027e0b5bf7cc35ce10e8ab11c1540c7477a9a03bcf1dcbf76c77452fa6c2b6"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:01:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b2027e0b5bf7cc35ce10e8ab11c1540c7477a9a03bcf1dcbf76c77452fa6c2b6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:01:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b2027e0b5bf7cc35ce10e8ab11c1540c7477a9a03bcf1dcbf76c77452fa6c2b6","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:01:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bb35e0d4b17b4d5ca1ae4cb730c86731ab4c4e07e02af1c64671f9a8c4c16868"}
{"level":"debug","ts":"2026-07-12T20:01:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"09006d98ceeca10d440996ffda0e81a64683d550ed1c3354b7ec9d72211222c0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:01:44Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:01:44Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-12T20:01:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/eef171055d3cc90c2e58999aae3c17bae93199ff1cf260d9df31e755cb9a3ff0","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:01:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"09006d98ceeca10d440996ffda0e81a64683d550ed1c3354b7ec9d72211222c0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:01:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"09006d98ceeca10d440996ffda0e81a64683d550ed1c3354b7ec9d72211222c0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:01:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"09006d98ceeca10d440996ffda0e81a64683d550ed1c3354b7ec9d72211222c0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:01:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b2027e0b5bf7cc35ce10e8ab11c1540c7477a9a03bcf1dcbf76c77452fa6c2b6","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:01:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/eef171055d3cc90c2e58999aae3c17bae93199ff1cf260d9df31e755cb9a3ff0"}
{"level":"debug","ts":"2026-07-12T20:01:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/b2027e0b5bf7cc35ce10e8ab11c1540c7477a9a03bcf1dcbf76c77452fa6c2b6","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:01:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"09006d98ceeca10d440996ffda0e81a64683d550ed1c3354b7ec9d72211222c0","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:01:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b2027e0b5bf7cc35ce10e8ab11c1540c7477a9a03bcf1dcbf76c77452fa6c2b6"}
{"level":"debug","ts":"2026-07-12T20:01:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/09006d98ceeca10d440996ffda0e81a64683d550ed1c3354b7ec9d72211222c0","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:01:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/09006d98ceeca10d440996ffda0e81a64683d550ed1c3354b7ec9d72211222c0"}
{"level":"debug","ts":"2026-07-12T20:01:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"09006d98ceeca10d440996ffda0e81a64683d550ed1c3354b7ec9d72211222c0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:01:44Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:01:44Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["09006d98ceeca10d440996ffda0e81a64683d550ed1c3354b7ec9d72211222c0"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:01:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"09006d98ceeca10d440996ffda0e81a64683d550ed1c3354b7ec9d72211222c0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:01:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"09006d98ceeca10d440996ffda0e81a64683d550ed1c3354b7ec9d72211222c0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:01:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/09006d98ceeca10d440996ffda0e81a64683d550ed1c3354b7ec9d72211222c0","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:01:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/09006d98ceeca10d440996ffda0e81a64683d550ed1c3354b7ec9d72211222c0"}
{"level":"debug","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"99ae61318989c510af27c23d7349323de4f9b8fb3fb29de5345d7a0d76ae7d5f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:02:07Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:02:07Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/99ae61318989c510af27c23d7349323de4f9b8fb3fb29de5345d7a0d76ae7d5f","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"99ae61318989c510af27c23d7349323de4f9b8fb3fb29de5345d7a0d76ae7d5f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"99ae61318989c510af27c23d7349323de4f9b8fb3fb29de5345d7a0d76ae7d5f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:02:07Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:02:07Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"99ae61318989c510af27c23d7349323de4f9b8fb3fb29de5345d7a0d76ae7d5f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"99ae61318989c510af27c23d7349323de4f9b8fb3fb29de5345d7a0d76ae7d5f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:02:07Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:02:07Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/99ae61318989c510af27c23d7349323de4f9b8fb3fb29de5345d7a0d76ae7d5f"}
{"level":"error","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"99ae61318989c510af27c23d7349323de4f9b8fb3fb29de5345d7a0d76ae7d5f","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"99ae61318989c510af27c23d7349323de4f9b8fb3fb29de5345d7a0d76ae7d5f\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"99ae61318989c510af27c23d7349323de4f9b8fb3fb29de5345d7a0d76ae7d5f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/99ae61318989c510af27c23d7349323de4f9b8fb3fb29de5345d7a0d76ae7d5f","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"99ae61318989c510af27c23d7349323de4f9b8fb3fb29de5345d7a0d76ae7d5f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/99ae61318989c510af27c23d7349323de4f9b8fb3fb29de5345d7a0d76ae7d5f"}
{"level":"debug","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"99ae61318989c510af27c23d7349323de4f9b8fb3fb29de5345d7a0d76ae7d5f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:02:07Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:02:07Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["99ae61318989c510af27c23d7349323de4f9b8fb3fb29de5345d7a0d76ae7d5f"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"99ae61318989c510af27c23d7349323de4f9b8fb3fb29de5345d7a0d76ae7d5f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"99ae61318989c510af27c23d7349323de4f9b8fb3fb29de5345d7a0d76ae7d5f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/99ae61318989c510af27c23d7349323de4f9b8fb3fb29de5345d7a0d76ae7d5f","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/99ae61318989c510af27c23d7349323de4f9b8fb3fb29de5345d7a0d76ae7d5f"}
{"level":"debug","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4ba261fd3c3c7a2a194bb9fae3ac72c27be7d1a7f9fb8cec904f57d17b69af09","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:02:07Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:02:07Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4ba261fd3c3c7a2a194bb9fae3ac72c27be7d1a7f9fb8cec904f57d17b69af09","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4ba261fd3c3c7a2a194bb9fae3ac72c27be7d1a7f9fb8cec904f57d17b69af09","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4ba261fd3c3c7a2a194bb9fae3ac72c27be7d1a7f9fb8cec904f57d17b69af09","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4ba261fd3c3c7a2a194bb9fae3ac72c27be7d1a7f9fb8cec904f57d17b69af09","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4ba261fd3c3c7a2a194bb9fae3ac72c27be7d1a7f9fb8cec904f57d17b69af09"}
{"level":"debug","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4ba261fd3c3c7a2a194bb9fae3ac72c27be7d1a7f9fb8cec904f57d17b69af09","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4ba261fd3c3c7a2a194bb9fae3ac72c27be7d1a7f9fb8cec904f57d17b69af09","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4ba261fd3c3c7a2a194bb9fae3ac72c27be7d1a7f9fb8cec904f57d17b69af09"}
{"level":"debug","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4ba261fd3c3c7a2a194bb9fae3ac72c27be7d1a7f9fb8cec904f57d17b69af09","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:02:07Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:02:07Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4ba261fd3c3c7a2a194bb9fae3ac72c27be7d1a7f9fb8cec904f57d17b69af09"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4ba261fd3c3c7a2a194bb9fae3ac72c27be7d1a7f9fb8cec904f57d17b69af09","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4ba261fd3c3c7a2a194bb9fae3ac72c27be7d1a7f9fb8cec904f57d17b69af09","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:02:07Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:02:07Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4ba261fd3c3c7a2a194bb9fae3ac72c27be7d1a7f9fb8cec904f57d17b69af09","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4ba261fd3c3c7a2a194bb9fae3ac72c27be7d1a7f9fb8cec904f57d17b69af09","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4ba261fd3c3c7a2a194bb9fae3ac72c27be7d1a7f9fb8cec904f57d17b69af09","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4ba261fd3c3c7a2a194bb9fae3ac72c27be7d1a7f9fb8cec904f57d17b69af09","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4ba261fd3c3c7a2a194bb9fae3ac72c27be7d1a7f9fb8cec904f57d17b69af09"}
{"level":"debug","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4ba261fd3c3c7a2a194bb9fae3ac72c27be7d1a7f9fb8cec904f57d17b69af09","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4ba261fd3c3c7a2a194bb9fae3ac72c27be7d1a7f9fb8cec904f57d17b69af09","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4ba261fd3c3c7a2a194bb9fae3ac72c27be7d1a7f9fb8cec904f57d17b69af09"}
{"level":"debug","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4ba261fd3c3c7a2a194bb9fae3ac72c27be7d1a7f9fb8cec904f57d17b69af09","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:02:07Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:02:07Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4ba261fd3c3c7a2a194bb9fae3ac72c27be7d1a7f9fb8cec904f57d17b69af09"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4ba261fd3c3c7a2a194bb9fae3ac72c27be7d1a7f9fb8cec904f57d17b69af09","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4ba261fd3c3c7a2a194bb9fae3ac72c27be7d1a7f9fb8cec904f57d17b69af09","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:02:07Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:02:07Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4ba261fd3c3c7a2a194bb9fae3ac72c27be7d1a7f9fb8cec904f57d17b69af09","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4ba261fd3c3c7a2a194bb9fae3ac72c27be7d1a7f9fb8cec904f57d17b69af09","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4afefd3ea4bcea72b642967721e8293dc2fb652f59e72794957c6b28b47587cc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:02:07Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:02:07Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4afefd3ea4bcea72b642967721e8293dc2fb652f59e72794957c6b28b47587cc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4ba261fd3c3c7a2a194bb9fae3ac72c27be7d1a7f9fb8cec904f57d17b69af09","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4ba261fd3c3c7a2a194bb9fae3ac72c27be7d1a7f9fb8cec904f57d17b69af09"}
{"level":"debug","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4afefd3ea4bcea72b642967721e8293dc2fb652f59e72794957c6b28b47587cc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:02:07Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:02:07Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4afefd3ea4bcea72b642967721e8293dc2fb652f59e72794957c6b28b47587cc","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4afefd3ea4bcea72b642967721e8293dc2fb652f59e72794957c6b28b47587cc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4ba261fd3c3c7a2a194bb9fae3ac72c27be7d1a7f9fb8cec904f57d17b69af09","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:02:07Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:02:07Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4ba261fd3c3c7a2a194bb9fae3ac72c27be7d1a7f9fb8cec904f57d17b69af09"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4afefd3ea4bcea72b642967721e8293dc2fb652f59e72794957c6b28b47587cc"}
{"level":"info","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4ba261fd3c3c7a2a194bb9fae3ac72c27be7d1a7f9fb8cec904f57d17b69af09","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4afefd3ea4bcea72b642967721e8293dc2fb652f59e72794957c6b28b47587cc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:02:07Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:02:07Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4afefd3ea4bcea72b642967721e8293dc2fb652f59e72794957c6b28b47587cc"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4ba261fd3c3c7a2a194bb9fae3ac72c27be7d1a7f9fb8cec904f57d17b69af09","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4afefd3ea4bcea72b642967721e8293dc2fb652f59e72794957c6b28b47587cc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4ba261fd3c3c7a2a194bb9fae3ac72c27be7d1a7f9fb8cec904f57d17b69af09","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:02:07Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:02:07Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4ba261fd3c3c7a2a194bb9fae3ac72c27be7d1a7f9fb8cec904f57d17b69af09"}
{"level":"info","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4ba261fd3c3c7a2a194bb9fae3ac72c27be7d1a7f9fb8cec904f57d17b69af09","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4afefd3ea4bcea72b642967721e8293dc2fb652f59e72794957c6b28b47587cc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:02:07Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:02:07Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4afefd3ea4bcea72b642967721e8293dc2fb652f59e72794957c6b28b47587cc","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4afefd3ea4bcea72b642967721e8293dc2fb652f59e72794957c6b28b47587cc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4ba261fd3c3c7a2a194bb9fae3ac72c27be7d1a7f9fb8cec904f57d17b69af09","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:02:07Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:02:07Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4ba261fd3c3c7a2a194bb9fae3ac72c27be7d1a7f9fb8cec904f57d17b69af09"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4afefd3ea4bcea72b642967721e8293dc2fb652f59e72794957c6b28b47587cc"}
{"level":"info","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4ba261fd3c3c7a2a194bb9fae3ac72c27be7d1a7f9fb8cec904f57d17b69af09","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4afefd3ea4bcea72b642967721e8293dc2fb652f59e72794957c6b28b47587cc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:02:07Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:02:07Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4afefd3ea4bcea72b642967721e8293dc2fb652f59e72794957c6b28b47587cc"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4ba261fd3c3c7a2a194bb9fae3ac72c27be7d1a7f9fb8cec904f57d17b69af09","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4afefd3ea4bcea72b642967721e8293dc2fb652f59e72794957c6b28b47587cc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4ba261fd3c3c7a2a194bb9fae3ac72c27be7d1a7f9fb8cec904f57d17b69af09","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:02:07Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:02:07Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4ba261fd3c3c7a2a194bb9fae3ac72c27be7d1a7f9fb8cec904f57d17b69af09"}
{"level":"debug","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4afefd3ea4bcea72b642967721e8293dc2fb652f59e72794957c6b28b47587cc","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4ba261fd3c3c7a2a194bb9fae3ac72c27be7d1a7f9fb8cec904f57d17b69af09","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4afefd3ea4bcea72b642967721e8293dc2fb652f59e72794957c6b28b47587cc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:02:07Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:02:07Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4afefd3ea4bcea72b642967721e8293dc2fb652f59e72794957c6b28b47587cc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4ba261fd3c3c7a2a194bb9fae3ac72c27be7d1a7f9fb8cec904f57d17b69af09","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:02:07Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:02:07Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4ba261fd3c3c7a2a194bb9fae3ac72c27be7d1a7f9fb8cec904f57d17b69af09"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4afefd3ea4bcea72b642967721e8293dc2fb652f59e72794957c6b28b47587cc"}
{"level":"debug","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4ba261fd3c3c7a2a194bb9fae3ac72c27be7d1a7f9fb8cec904f57d17b69af09","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4ba261fd3c3c7a2a194bb9fae3ac72c27be7d1a7f9fb8cec904f57d17b69af09","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4afefd3ea4bcea72b642967721e8293dc2fb652f59e72794957c6b28b47587cc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:02:07Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:02:07Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4afefd3ea4bcea72b642967721e8293dc2fb652f59e72794957c6b28b47587cc"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4afefd3ea4bcea72b642967721e8293dc2fb652f59e72794957c6b28b47587cc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4ba261fd3c3c7a2a194bb9fae3ac72c27be7d1a7f9fb8cec904f57d17b69af09","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:02:07Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:02:07Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4ba261fd3c3c7a2a194bb9fae3ac72c27be7d1a7f9fb8cec904f57d17b69af09"}
{"level":"debug","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4afefd3ea4bcea72b642967721e8293dc2fb652f59e72794957c6b28b47587cc","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4ba261fd3c3c7a2a194bb9fae3ac72c27be7d1a7f9fb8cec904f57d17b69af09","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4afefd3ea4bcea72b642967721e8293dc2fb652f59e72794957c6b28b47587cc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:02:07Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:02:07Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4afefd3ea4bcea72b642967721e8293dc2fb652f59e72794957c6b28b47587cc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4ba261fd3c3c7a2a194bb9fae3ac72c27be7d1a7f9fb8cec904f57d17b69af09","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:02:07Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:02:07Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4ba261fd3c3c7a2a194bb9fae3ac72c27be7d1a7f9fb8cec904f57d17b69af09"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4afefd3ea4bcea72b642967721e8293dc2fb652f59e72794957c6b28b47587cc"}
{"level":"info","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4ba261fd3c3c7a2a194bb9fae3ac72c27be7d1a7f9fb8cec904f57d17b69af09","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4afefd3ea4bcea72b642967721e8293dc2fb652f59e72794957c6b28b47587cc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:02:07Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:02:07Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4afefd3ea4bcea72b642967721e8293dc2fb652f59e72794957c6b28b47587cc"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4ba261fd3c3c7a2a194bb9fae3ac72c27be7d1a7f9fb8cec904f57d17b69af09","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4afefd3ea4bcea72b642967721e8293dc2fb652f59e72794957c6b28b47587cc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4ba261fd3c3c7a2a194bb9fae3ac72c27be7d1a7f9fb8cec904f57d17b69af09","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:02:07Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:02:07Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4ba261fd3c3c7a2a194bb9fae3ac72c27be7d1a7f9fb8cec904f57d17b69af09"}
{"level":"info","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4ba261fd3c3c7a2a194bb9fae3ac72c27be7d1a7f9fb8cec904f57d17b69af09","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4afefd3ea4bcea72b642967721e8293dc2fb652f59e72794957c6b28b47587cc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:02:07Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:02:07Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4afefd3ea4bcea72b642967721e8293dc2fb652f59e72794957c6b28b47587cc","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4afefd3ea4bcea72b642967721e8293dc2fb652f59e72794957c6b28b47587cc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4ba261fd3c3c7a2a194bb9fae3ac72c27be7d1a7f9fb8cec904f57d17b69af09","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:02:07Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:02:07Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4ba261fd3c3c7a2a194bb9fae3ac72c27be7d1a7f9fb8cec904f57d17b69af09"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4afefd3ea4bcea72b642967721e8293dc2fb652f59e72794957c6b28b47587cc"}
{"level":"info","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4ba261fd3c3c7a2a194bb9fae3ac72c27be7d1a7f9fb8cec904f57d17b69af09","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4afefd3ea4bcea72b642967721e8293dc2fb652f59e72794957c6b28b47587cc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:02:07Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:02:07Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4afefd3ea4bcea72b642967721e8293dc2fb652f59e72794957c6b28b47587cc"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4ba261fd3c3c7a2a194bb9fae3ac72c27be7d1a7f9fb8cec904f57d17b69af09","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4afefd3ea4bcea72b642967721e8293dc2fb652f59e72794957c6b28b47587cc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4ba261fd3c3c7a2a194bb9fae3ac72c27be7d1a7f9fb8cec904f57d17b69af09","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:02:07Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:02:07Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4ba261fd3c3c7a2a194bb9fae3ac72c27be7d1a7f9fb8cec904f57d17b69af09"}
{"level":"info","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4ba261fd3c3c7a2a194bb9fae3ac72c27be7d1a7f9fb8cec904f57d17b69af09","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4afefd3ea4bcea72b642967721e8293dc2fb652f59e72794957c6b28b47587cc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:02:08Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:02:08Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4afefd3ea4bcea72b642967721e8293dc2fb652f59e72794957c6b28b47587cc","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4afefd3ea4bcea72b642967721e8293dc2fb652f59e72794957c6b28b47587cc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4ba261fd3c3c7a2a194bb9fae3ac72c27be7d1a7f9fb8cec904f57d17b69af09","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:02:08Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:02:08Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4ba261fd3c3c7a2a194bb9fae3ac72c27be7d1a7f9fb8cec904f57d17b69af09"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4afefd3ea4bcea72b642967721e8293dc2fb652f59e72794957c6b28b47587cc"}
{"level":"info","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4ba261fd3c3c7a2a194bb9fae3ac72c27be7d1a7f9fb8cec904f57d17b69af09","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4afefd3ea4bcea72b642967721e8293dc2fb652f59e72794957c6b28b47587cc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:02:08Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:02:08Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4afefd3ea4bcea72b642967721e8293dc2fb652f59e72794957c6b28b47587cc"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4ba261fd3c3c7a2a194bb9fae3ac72c27be7d1a7f9fb8cec904f57d17b69af09","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4afefd3ea4bcea72b642967721e8293dc2fb652f59e72794957c6b28b47587cc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4ba261fd3c3c7a2a194bb9fae3ac72c27be7d1a7f9fb8cec904f57d17b69af09","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:02:08Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:02:08Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4ba261fd3c3c7a2a194bb9fae3ac72c27be7d1a7f9fb8cec904f57d17b69af09"}
{"level":"info","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4ba261fd3c3c7a2a194bb9fae3ac72c27be7d1a7f9fb8cec904f57d17b69af09","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4afefd3ea4bcea72b642967721e8293dc2fb652f59e72794957c6b28b47587cc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:02:08Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:02:08Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4afefd3ea4bcea72b642967721e8293dc2fb652f59e72794957c6b28b47587cc","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4afefd3ea4bcea72b642967721e8293dc2fb652f59e72794957c6b28b47587cc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4ba261fd3c3c7a2a194bb9fae3ac72c27be7d1a7f9fb8cec904f57d17b69af09","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:02:08Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:02:08Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4ba261fd3c3c7a2a194bb9fae3ac72c27be7d1a7f9fb8cec904f57d17b69af09"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4ba261fd3c3c7a2a194bb9fae3ac72c27be7d1a7f9fb8cec904f57d17b69af09","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4afefd3ea4bcea72b642967721e8293dc2fb652f59e72794957c6b28b47587cc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4ba261fd3c3c7a2a194bb9fae3ac72c27be7d1a7f9fb8cec904f57d17b69af09","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4afefd3ea4bcea72b642967721e8293dc2fb652f59e72794957c6b28b47587cc"}
{"level":"debug","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4ba261fd3c3c7a2a194bb9fae3ac72c27be7d1a7f9fb8cec904f57d17b69af09","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4afefd3ea4bcea72b642967721e8293dc2fb652f59e72794957c6b28b47587cc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:02:08Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:02:08Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4afefd3ea4bcea72b642967721e8293dc2fb652f59e72794957c6b28b47587cc"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4afefd3ea4bcea72b642967721e8293dc2fb652f59e72794957c6b28b47587cc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4afefd3ea4bcea72b642967721e8293dc2fb652f59e72794957c6b28b47587cc","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4ba261fd3c3c7a2a194bb9fae3ac72c27be7d1a7f9fb8cec904f57d17b69af09"}
{"level":"debug","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4afefd3ea4bcea72b642967721e8293dc2fb652f59e72794957c6b28b47587cc","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1ddd3be45151f582df1977ffbea51082a326bd758190b88f970b092b80202f4e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:02:08Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:02:08Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4afefd3ea4bcea72b642967721e8293dc2fb652f59e72794957c6b28b47587cc"}
{"level":"debug","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/1ddd3be45151f582df1977ffbea51082a326bd758190b88f970b092b80202f4e","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1ddd3be45151f582df1977ffbea51082a326bd758190b88f970b092b80202f4e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1ddd3be45151f582df1977ffbea51082a326bd758190b88f970b092b80202f4e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:02:08Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:02:08Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1ddd3be45151f582df1977ffbea51082a326bd758190b88f970b092b80202f4e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1ddd3be45151f582df1977ffbea51082a326bd758190b88f970b092b80202f4e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:02:08Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:02:08Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1ddd3be45151f582df1977ffbea51082a326bd758190b88f970b092b80202f4e"}
{"level":"error","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"1ddd3be45151f582df1977ffbea51082a326bd758190b88f970b092b80202f4e","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"1ddd3be45151f582df1977ffbea51082a326bd758190b88f970b092b80202f4e\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1ddd3be45151f582df1977ffbea51082a326bd758190b88f970b092b80202f4e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/1ddd3be45151f582df1977ffbea51082a326bd758190b88f970b092b80202f4e","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1ddd3be45151f582df1977ffbea51082a326bd758190b88f970b092b80202f4e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1ddd3be45151f582df1977ffbea51082a326bd758190b88f970b092b80202f4e"}
{"level":"debug","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1ddd3be45151f582df1977ffbea51082a326bd758190b88f970b092b80202f4e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:02:08Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:02:08Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1ddd3be45151f582df1977ffbea51082a326bd758190b88f970b092b80202f4e"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1ddd3be45151f582df1977ffbea51082a326bd758190b88f970b092b80202f4e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1ddd3be45151f582df1977ffbea51082a326bd758190b88f970b092b80202f4e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/1ddd3be45151f582df1977ffbea51082a326bd758190b88f970b092b80202f4e","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1ddd3be45151f582df1977ffbea51082a326bd758190b88f970b092b80202f4e"}
{"level":"debug","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"83bbf45937cd34a3d178e1552910cb0fbf31a96829538aa03d276217b2860084","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:02:08Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:02:08Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/83bbf45937cd34a3d178e1552910cb0fbf31a96829538aa03d276217b2860084","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"83bbf45937cd34a3d178e1552910cb0fbf31a96829538aa03d276217b2860084","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"83bbf45937cd34a3d178e1552910cb0fbf31a96829538aa03d276217b2860084","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"83bbf45937cd34a3d178e1552910cb0fbf31a96829538aa03d276217b2860084","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/83bbf45937cd34a3d178e1552910cb0fbf31a96829538aa03d276217b2860084"}
{"level":"debug","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/83bbf45937cd34a3d178e1552910cb0fbf31a96829538aa03d276217b2860084","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"83bbf45937cd34a3d178e1552910cb0fbf31a96829538aa03d276217b2860084","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/83bbf45937cd34a3d178e1552910cb0fbf31a96829538aa03d276217b2860084"}
{"level":"debug","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"83bbf45937cd34a3d178e1552910cb0fbf31a96829538aa03d276217b2860084","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:02:08Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:02:08Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["83bbf45937cd34a3d178e1552910cb0fbf31a96829538aa03d276217b2860084"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"83bbf45937cd34a3d178e1552910cb0fbf31a96829538aa03d276217b2860084","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"83bbf45937cd34a3d178e1552910cb0fbf31a96829538aa03d276217b2860084","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:02:08Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:02:08Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/83bbf45937cd34a3d178e1552910cb0fbf31a96829538aa03d276217b2860084","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"83bbf45937cd34a3d178e1552910cb0fbf31a96829538aa03d276217b2860084","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"83bbf45937cd34a3d178e1552910cb0fbf31a96829538aa03d276217b2860084","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"83bbf45937cd34a3d178e1552910cb0fbf31a96829538aa03d276217b2860084","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/83bbf45937cd34a3d178e1552910cb0fbf31a96829538aa03d276217b2860084"}
{"level":"debug","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/83bbf45937cd34a3d178e1552910cb0fbf31a96829538aa03d276217b2860084","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"83bbf45937cd34a3d178e1552910cb0fbf31a96829538aa03d276217b2860084","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/83bbf45937cd34a3d178e1552910cb0fbf31a96829538aa03d276217b2860084"}
{"level":"debug","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"83bbf45937cd34a3d178e1552910cb0fbf31a96829538aa03d276217b2860084","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:02:08Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:02:08Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["83bbf45937cd34a3d178e1552910cb0fbf31a96829538aa03d276217b2860084"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"83bbf45937cd34a3d178e1552910cb0fbf31a96829538aa03d276217b2860084","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"83bbf45937cd34a3d178e1552910cb0fbf31a96829538aa03d276217b2860084","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:02:08Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:02:08Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/83bbf45937cd34a3d178e1552910cb0fbf31a96829538aa03d276217b2860084","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"83bbf45937cd34a3d178e1552910cb0fbf31a96829538aa03d276217b2860084","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"83bbf45937cd34a3d178e1552910cb0fbf31a96829538aa03d276217b2860084","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e995257ce44cf33976e6f2c9df520c993faae332f8c0db390d429bb6ab47e192","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:02:08Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:02:08Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/83bbf45937cd34a3d178e1552910cb0fbf31a96829538aa03d276217b2860084"}
{"level":"info","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e995257ce44cf33976e6f2c9df520c993faae332f8c0db390d429bb6ab47e192","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"83bbf45937cd34a3d178e1552910cb0fbf31a96829538aa03d276217b2860084","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:02:08Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:02:08Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["83bbf45937cd34a3d178e1552910cb0fbf31a96829538aa03d276217b2860084"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/e995257ce44cf33976e6f2c9df520c993faae332f8c0db390d429bb6ab47e192","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"83bbf45937cd34a3d178e1552910cb0fbf31a96829538aa03d276217b2860084","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e995257ce44cf33976e6f2c9df520c993faae332f8c0db390d429bb6ab47e192","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:02:08Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:02:08Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e995257ce44cf33976e6f2c9df520c993faae332f8c0db390d429bb6ab47e192"}
{"level":"info","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e995257ce44cf33976e6f2c9df520c993faae332f8c0db390d429bb6ab47e192","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"83bbf45937cd34a3d178e1552910cb0fbf31a96829538aa03d276217b2860084","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:02:08Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:02:08Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/83bbf45937cd34a3d178e1552910cb0fbf31a96829538aa03d276217b2860084","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"83bbf45937cd34a3d178e1552910cb0fbf31a96829538aa03d276217b2860084","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e995257ce44cf33976e6f2c9df520c993faae332f8c0db390d429bb6ab47e192","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:02:08Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:02:08Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e995257ce44cf33976e6f2c9df520c993faae332f8c0db390d429bb6ab47e192"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/83bbf45937cd34a3d178e1552910cb0fbf31a96829538aa03d276217b2860084"}
{"level":"info","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e995257ce44cf33976e6f2c9df520c993faae332f8c0db390d429bb6ab47e192","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"83bbf45937cd34a3d178e1552910cb0fbf31a96829538aa03d276217b2860084","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:02:08Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:02:08Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["83bbf45937cd34a3d178e1552910cb0fbf31a96829538aa03d276217b2860084"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/e995257ce44cf33976e6f2c9df520c993faae332f8c0db390d429bb6ab47e192","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"83bbf45937cd34a3d178e1552910cb0fbf31a96829538aa03d276217b2860084","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e995257ce44cf33976e6f2c9df520c993faae332f8c0db390d429bb6ab47e192","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:02:08Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:02:08Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e995257ce44cf33976e6f2c9df520c993faae332f8c0db390d429bb6ab47e192","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"83bbf45937cd34a3d178e1552910cb0fbf31a96829538aa03d276217b2860084","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e995257ce44cf33976e6f2c9df520c993faae332f8c0db390d429bb6ab47e192"}
{"level":"debug","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e995257ce44cf33976e6f2c9df520c993faae332f8c0db390d429bb6ab47e192","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:02:08Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:02:08Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e995257ce44cf33976e6f2c9df520c993faae332f8c0db390d429bb6ab47e192"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/83bbf45937cd34a3d178e1552910cb0fbf31a96829538aa03d276217b2860084","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e995257ce44cf33976e6f2c9df520c993faae332f8c0db390d429bb6ab47e192","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d687df711b0f7d675202d76da80c71a5214ed84e3f20e330483d262ed723d0b5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:02:08Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:02:08Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/83bbf45937cd34a3d178e1552910cb0fbf31a96829538aa03d276217b2860084"}
{"level":"info","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d687df711b0f7d675202d76da80c71a5214ed84e3f20e330483d262ed723d0b5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e995257ce44cf33976e6f2c9df520c993faae332f8c0db390d429bb6ab47e192","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:02:08Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:02:08Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/e995257ce44cf33976e6f2c9df520c993faae332f8c0db390d429bb6ab47e192","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e995257ce44cf33976e6f2c9df520c993faae332f8c0db390d429bb6ab47e192"}
{"level":"debug","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/d687df711b0f7d675202d76da80c71a5214ed84e3f20e330483d262ed723d0b5","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e995257ce44cf33976e6f2c9df520c993faae332f8c0db390d429bb6ab47e192","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d687df711b0f7d675202d76da80c71a5214ed84e3f20e330483d262ed723d0b5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:02:08Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:02:08Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d687df711b0f7d675202d76da80c71a5214ed84e3f20e330483d262ed723d0b5"}
{"level":"debug","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/e995257ce44cf33976e6f2c9df520c993faae332f8c0db390d429bb6ab47e192","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e995257ce44cf33976e6f2c9df520c993faae332f8c0db390d429bb6ab47e192"}
{"level":"info","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d687df711b0f7d675202d76da80c71a5214ed84e3f20e330483d262ed723d0b5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e995257ce44cf33976e6f2c9df520c993faae332f8c0db390d429bb6ab47e192","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:02:08Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:02:08Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e995257ce44cf33976e6f2c9df520c993faae332f8c0db390d429bb6ab47e192"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/d687df711b0f7d675202d76da80c71a5214ed84e3f20e330483d262ed723d0b5","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d687df711b0f7d675202d76da80c71a5214ed84e3f20e330483d262ed723d0b5"}
{"level":"debug","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/95014eebbc08a3a479e2bc1cff1a419e9d3051f2a828516f4eaa1e1abc819601","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e995257ce44cf33976e6f2c9df520c993faae332f8c0db390d429bb6ab47e192","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d687df711b0f7d675202d76da80c71a5214ed84e3f20e330483d262ed723d0b5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:02:08Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:02:08Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d687df711b0f7d675202d76da80c71a5214ed84e3f20e330483d262ed723d0b5"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/95014eebbc08a3a479e2bc1cff1a419e9d3051f2a828516f4eaa1e1abc819601"}
{"level":"debug","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/e995257ce44cf33976e6f2c9df520c993faae332f8c0db390d429bb6ab47e192","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d687df711b0f7d675202d76da80c71a5214ed84e3f20e330483d262ed723d0b5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"95014eebbc08a3a479e2bc1cff1a419e9d3051f2a828516f4eaa1e1abc819601","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:02:08Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:02:08Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["95014eebbc08a3a479e2bc1cff1a419e9d3051f2a828516f4eaa1e1abc819601"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e995257ce44cf33976e6f2c9df520c993faae332f8c0db390d429bb6ab47e192"}
{"level":"debug","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/d687df711b0f7d675202d76da80c71a5214ed84e3f20e330483d262ed723d0b5","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"95014eebbc08a3a479e2bc1cff1a419e9d3051f2a828516f4eaa1e1abc819601","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e995257ce44cf33976e6f2c9df520c993faae332f8c0db390d429bb6ab47e192","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d687df711b0f7d675202d76da80c71a5214ed84e3f20e330483d262ed723d0b5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:02:08Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:02:08Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d687df711b0f7d675202d76da80c71a5214ed84e3f20e330483d262ed723d0b5"}
{"level":"debug","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/95014eebbc08a3a479e2bc1cff1a419e9d3051f2a828516f4eaa1e1abc819601","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/95014eebbc08a3a479e2bc1cff1a419e9d3051f2a828516f4eaa1e1abc819601"}
{"level":"info","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d687df711b0f7d675202d76da80c71a5214ed84e3f20e330483d262ed723d0b5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"95014eebbc08a3a479e2bc1cff1a419e9d3051f2a828516f4eaa1e1abc819601","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d687df711b0f7d675202d76da80c71a5214ed84e3f20e330483d262ed723d0b5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/d687df711b0f7d675202d76da80c71a5214ed84e3f20e330483d262ed723d0b5","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d687df711b0f7d675202d76da80c71a5214ed84e3f20e330483d262ed723d0b5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d687df711b0f7d675202d76da80c71a5214ed84e3f20e330483d262ed723d0b5","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d687df711b0f7d675202d76da80c71a5214ed84e3f20e330483d262ed723d0b5"}
{"level":"debug","ts":"2026-07-12T20:02:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d687df711b0f7d675202d76da80c71a5214ed84e3f20e330483d262ed723d0b5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:02:08Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:02:08Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d687df711b0f7d675202d76da80c71a5214ed84e3f20e330483d262ed723d0b5"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:02:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d687df711b0f7d675202d76da80c71a5214ed84e3f20e330483d262ed723d0b5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d687df711b0f7d675202d76da80c71a5214ed84e3f20e330483d262ed723d0b5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:02:09Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:02:09Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-12T20:02:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/d687df711b0f7d675202d76da80c71a5214ed84e3f20e330483d262ed723d0b5","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:02:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d687df711b0f7d675202d76da80c71a5214ed84e3f20e330483d262ed723d0b5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d687df711b0f7d675202d76da80c71a5214ed84e3f20e330483d262ed723d0b5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d687df711b0f7d675202d76da80c71a5214ed84e3f20e330483d262ed723d0b5","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:02:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d687df711b0f7d675202d76da80c71a5214ed84e3f20e330483d262ed723d0b5"}
{"level":"debug","ts":"2026-07-12T20:02:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/d687df711b0f7d675202d76da80c71a5214ed84e3f20e330483d262ed723d0b5","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:02:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d687df711b0f7d675202d76da80c71a5214ed84e3f20e330483d262ed723d0b5","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:02:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d687df711b0f7d675202d76da80c71a5214ed84e3f20e330483d262ed723d0b5"}
{"level":"debug","ts":"2026-07-12T20:02:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d687df711b0f7d675202d76da80c71a5214ed84e3f20e330483d262ed723d0b5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:02:09Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:02:09Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d687df711b0f7d675202d76da80c71a5214ed84e3f20e330483d262ed723d0b5"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:02:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d687df711b0f7d675202d76da80c71a5214ed84e3f20e330483d262ed723d0b5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d687df711b0f7d675202d76da80c71a5214ed84e3f20e330483d262ed723d0b5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/d687df711b0f7d675202d76da80c71a5214ed84e3f20e330483d262ed723d0b5","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:02:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d687df711b0f7d675202d76da80c71a5214ed84e3f20e330483d262ed723d0b5"}
{"level":"debug","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"83bbf45937cd34a3d178e1552910cb0fbf31a96829538aa03d276217b2860084","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/83bbf45937cd34a3d178e1552910cb0fbf31a96829538aa03d276217b2860084","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/83bbf45937cd34a3d178e1552910cb0fbf31a96829538aa03d276217b2860084"}
{"level":"debug","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"99ae61318989c510af27c23d7349323de4f9b8fb3fb29de5345d7a0d76ae7d5f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:02:27Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:02:27Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/99ae61318989c510af27c23d7349323de4f9b8fb3fb29de5345d7a0d76ae7d5f","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"99ae61318989c510af27c23d7349323de4f9b8fb3fb29de5345d7a0d76ae7d5f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"99ae61318989c510af27c23d7349323de4f9b8fb3fb29de5345d7a0d76ae7d5f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"99ae61318989c510af27c23d7349323de4f9b8fb3fb29de5345d7a0d76ae7d5f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/99ae61318989c510af27c23d7349323de4f9b8fb3fb29de5345d7a0d76ae7d5f"}
{"level":"debug","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/99ae61318989c510af27c23d7349323de4f9b8fb3fb29de5345d7a0d76ae7d5f","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"99ae61318989c510af27c23d7349323de4f9b8fb3fb29de5345d7a0d76ae7d5f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/99ae61318989c510af27c23d7349323de4f9b8fb3fb29de5345d7a0d76ae7d5f"}
{"level":"debug","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"99ae61318989c510af27c23d7349323de4f9b8fb3fb29de5345d7a0d76ae7d5f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:02:27Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:02:27Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["99ae61318989c510af27c23d7349323de4f9b8fb3fb29de5345d7a0d76ae7d5f"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"99ae61318989c510af27c23d7349323de4f9b8fb3fb29de5345d7a0d76ae7d5f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"99ae61318989c510af27c23d7349323de4f9b8fb3fb29de5345d7a0d76ae7d5f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:02:27Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:02:27Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/99ae61318989c510af27c23d7349323de4f9b8fb3fb29de5345d7a0d76ae7d5f","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"99ae61318989c510af27c23d7349323de4f9b8fb3fb29de5345d7a0d76ae7d5f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"99ae61318989c510af27c23d7349323de4f9b8fb3fb29de5345d7a0d76ae7d5f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"99ae61318989c510af27c23d7349323de4f9b8fb3fb29de5345d7a0d76ae7d5f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/99ae61318989c510af27c23d7349323de4f9b8fb3fb29de5345d7a0d76ae7d5f"}
{"level":"debug","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/99ae61318989c510af27c23d7349323de4f9b8fb3fb29de5345d7a0d76ae7d5f","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"99ae61318989c510af27c23d7349323de4f9b8fb3fb29de5345d7a0d76ae7d5f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/99ae61318989c510af27c23d7349323de4f9b8fb3fb29de5345d7a0d76ae7d5f"}
{"level":"debug","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"99ae61318989c510af27c23d7349323de4f9b8fb3fb29de5345d7a0d76ae7d5f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:02:27Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:02:27Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["99ae61318989c510af27c23d7349323de4f9b8fb3fb29de5345d7a0d76ae7d5f"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"99ae61318989c510af27c23d7349323de4f9b8fb3fb29de5345d7a0d76ae7d5f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"99ae61318989c510af27c23d7349323de4f9b8fb3fb29de5345d7a0d76ae7d5f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/99ae61318989c510af27c23d7349323de4f9b8fb3fb29de5345d7a0d76ae7d5f","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dfb3b6da41117eca2f16fc173ddbb334b86f2c8ec4d91585fe9473dc2dd3ed03","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/99ae61318989c510af27c23d7349323de4f9b8fb3fb29de5345d7a0d76ae7d5f"}
{"level":"debug","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/dfb3b6da41117eca2f16fc173ddbb334b86f2c8ec4d91585fe9473dc2dd3ed03","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dfb3b6da41117eca2f16fc173ddbb334b86f2c8ec4d91585fe9473dc2dd3ed03"}
{"level":"debug","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"eef171055d3cc90c2e58999aae3c17bae93199ff1cf260d9df31e755cb9a3ff0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:02:27Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:02:27Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/eef171055d3cc90c2e58999aae3c17bae93199ff1cf260d9df31e755cb9a3ff0","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"eef171055d3cc90c2e58999aae3c17bae93199ff1cf260d9df31e755cb9a3ff0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"eef171055d3cc90c2e58999aae3c17bae93199ff1cf260d9df31e755cb9a3ff0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"eef171055d3cc90c2e58999aae3c17bae93199ff1cf260d9df31e755cb9a3ff0","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/eef171055d3cc90c2e58999aae3c17bae93199ff1cf260d9df31e755cb9a3ff0"}
{"level":"debug","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/eef171055d3cc90c2e58999aae3c17bae93199ff1cf260d9df31e755cb9a3ff0","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"eef171055d3cc90c2e58999aae3c17bae93199ff1cf260d9df31e755cb9a3ff0","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/eef171055d3cc90c2e58999aae3c17bae93199ff1cf260d9df31e755cb9a3ff0"}
{"level":"debug","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"eef171055d3cc90c2e58999aae3c17bae93199ff1cf260d9df31e755cb9a3ff0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:02:27Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:02:27Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["eef171055d3cc90c2e58999aae3c17bae93199ff1cf260d9df31e755cb9a3ff0"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"eef171055d3cc90c2e58999aae3c17bae93199ff1cf260d9df31e755cb9a3ff0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"eef171055d3cc90c2e58999aae3c17bae93199ff1cf260d9df31e755cb9a3ff0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:02:27Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:02:27Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/eef171055d3cc90c2e58999aae3c17bae93199ff1cf260d9df31e755cb9a3ff0","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"eef171055d3cc90c2e58999aae3c17bae93199ff1cf260d9df31e755cb9a3ff0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"86d7031d507d6d31ee8bd9bdcfe4da1ec7d3ef91ae9fcfea8ed412594eae9e2b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"eef171055d3cc90c2e58999aae3c17bae93199ff1cf260d9df31e755cb9a3ff0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"eef171055d3cc90c2e58999aae3c17bae93199ff1cf260d9df31e755cb9a3ff0","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/eef171055d3cc90c2e58999aae3c17bae93199ff1cf260d9df31e755cb9a3ff0"}
{"level":"debug","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/86d7031d507d6d31ee8bd9bdcfe4da1ec7d3ef91ae9fcfea8ed412594eae9e2b","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"eef171055d3cc90c2e58999aae3c17bae93199ff1cf260d9df31e755cb9a3ff0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:02:27Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:02:27Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["eef171055d3cc90c2e58999aae3c17bae93199ff1cf260d9df31e755cb9a3ff0"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"eef171055d3cc90c2e58999aae3c17bae93199ff1cf260d9df31e755cb9a3ff0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"eef171055d3cc90c2e58999aae3c17bae93199ff1cf260d9df31e755cb9a3ff0","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/86d7031d507d6d31ee8bd9bdcfe4da1ec7d3ef91ae9fcfea8ed412594eae9e2b"}
{"level":"debug","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/eef171055d3cc90c2e58999aae3c17bae93199ff1cf260d9df31e755cb9a3ff0","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/eef171055d3cc90c2e58999aae3c17bae93199ff1cf260d9df31e755cb9a3ff0"}
{"level":"debug","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"096ebadafe5a6aea8d6dfb3a4dd7299f8068cb7f885de93472daca06ab52d6fc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:02:27Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:02:27Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/096ebadafe5a6aea8d6dfb3a4dd7299f8068cb7f885de93472daca06ab52d6fc","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"096ebadafe5a6aea8d6dfb3a4dd7299f8068cb7f885de93472daca06ab52d6fc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"096ebadafe5a6aea8d6dfb3a4dd7299f8068cb7f885de93472daca06ab52d6fc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"096ebadafe5a6aea8d6dfb3a4dd7299f8068cb7f885de93472daca06ab52d6fc","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/096ebadafe5a6aea8d6dfb3a4dd7299f8068cb7f885de93472daca06ab52d6fc"}
{"level":"debug","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/096ebadafe5a6aea8d6dfb3a4dd7299f8068cb7f885de93472daca06ab52d6fc","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"096ebadafe5a6aea8d6dfb3a4dd7299f8068cb7f885de93472daca06ab52d6fc","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/096ebadafe5a6aea8d6dfb3a4dd7299f8068cb7f885de93472daca06ab52d6fc"}
{"level":"debug","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"096ebadafe5a6aea8d6dfb3a4dd7299f8068cb7f885de93472daca06ab52d6fc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:02:27Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:02:27Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["096ebadafe5a6aea8d6dfb3a4dd7299f8068cb7f885de93472daca06ab52d6fc"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"096ebadafe5a6aea8d6dfb3a4dd7299f8068cb7f885de93472daca06ab52d6fc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"096ebadafe5a6aea8d6dfb3a4dd7299f8068cb7f885de93472daca06ab52d6fc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:02:27Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:02:27Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/096ebadafe5a6aea8d6dfb3a4dd7299f8068cb7f885de93472daca06ab52d6fc","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"096ebadafe5a6aea8d6dfb3a4dd7299f8068cb7f885de93472daca06ab52d6fc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"096ebadafe5a6aea8d6dfb3a4dd7299f8068cb7f885de93472daca06ab52d6fc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"096ebadafe5a6aea8d6dfb3a4dd7299f8068cb7f885de93472daca06ab52d6fc","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/096ebadafe5a6aea8d6dfb3a4dd7299f8068cb7f885de93472daca06ab52d6fc"}
{"level":"debug","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/096ebadafe5a6aea8d6dfb3a4dd7299f8068cb7f885de93472daca06ab52d6fc","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"096ebadafe5a6aea8d6dfb3a4dd7299f8068cb7f885de93472daca06ab52d6fc","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/096ebadafe5a6aea8d6dfb3a4dd7299f8068cb7f885de93472daca06ab52d6fc"}
{"level":"debug","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"096ebadafe5a6aea8d6dfb3a4dd7299f8068cb7f885de93472daca06ab52d6fc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:02:27Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:02:27Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["096ebadafe5a6aea8d6dfb3a4dd7299f8068cb7f885de93472daca06ab52d6fc"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"096ebadafe5a6aea8d6dfb3a4dd7299f8068cb7f885de93472daca06ab52d6fc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"096ebadafe5a6aea8d6dfb3a4dd7299f8068cb7f885de93472daca06ab52d6fc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T20:02:27Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T20:02:27Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/096ebadafe5a6aea8d6dfb3a4dd7299f8068cb7f885de93472daca06ab52d6fc","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"096ebadafe5a6aea8d6dfb3a4dd7299f8068cb7f885de93472daca06ab52d6fc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2cd886926c990cc533fc61bcc58d2267e3283668d7b8a084238691cd7893c7be","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"096ebadafe5a6aea8d6dfb3a4dd7299f8068cb7f885de93472daca06ab52d6fc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"096ebadafe5a6aea8d6dfb3a4dd7299f8068cb7f885de93472daca06ab52d6fc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"09006d98ceeca10d440996ffda0e81a64683d550ed1c3354b7ec9d72211222c0","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/096ebadafe5a6aea8d6dfb3a4dd7299f8068cb7f885de93472daca06ab52d6fc"}
{"level":"debug","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/2cd886926c990cc533fc61bcc58d2267e3283668d7b8a084238691cd7893c7be","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"096ebadafe5a6aea8d6dfb3a4dd7299f8068cb7f885de93472daca06ab52d6fc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T20:02:27Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T20:02:27Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["096ebadafe5a6aea8d6dfb3a4dd7299f8068cb7f885de93472daca06ab52d6fc"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2cd886926c990cc533fc61bcc58d2267e3283668d7b8a084238691cd7893c7be"}
{"level":"info","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"096ebadafe5a6aea8d6dfb3a4dd7299f8068cb7f885de93472daca06ab52d6fc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e995257ce44cf33976e6f2c9df520c993faae332f8c0db390d429bb6ab47e192","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"096ebadafe5a6aea8d6dfb3a4dd7299f8068cb7f885de93472daca06ab52d6fc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/09006d98ceeca10d440996ffda0e81a64683d550ed1c3354b7ec9d72211222c0","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/09006d98ceeca10d440996ffda0e81a64683d550ed1c3354b7ec9d72211222c0"}
{"level":"debug","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/096ebadafe5a6aea8d6dfb3a4dd7299f8068cb7f885de93472daca06ab52d6fc","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/096ebadafe5a6aea8d6dfb3a4dd7299f8068cb7f885de93472daca06ab52d6fc"}
{"level":"debug","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/e995257ce44cf33976e6f2c9df520c993faae332f8c0db390d429bb6ab47e192","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ee6fe41741d318ef9a23db979185da67e66f4ff7b4ced5159dd8a35df3c98c27","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1ddd3be45151f582df1977ffbea51082a326bd758190b88f970b092b80202f4e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e995257ce44cf33976e6f2c9df520c993faae332f8c0db390d429bb6ab47e192"}
{"level":"debug","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/ee6fe41741d318ef9a23db979185da67e66f4ff7b4ced5159dd8a35df3c98c27","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4afefd3ea4bcea72b642967721e8293dc2fb652f59e72794957c6b28b47587cc","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ee6fe41741d318ef9a23db979185da67e66f4ff7b4ced5159dd8a35df3c98c27"}
{"level":"debug","ts":"2026-07-12T20:02:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/1ddd3be45151f582df1977ffbea51082a326bd758190b88f970b092b80202f4e","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:02:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1ddd3be45151f582df1977ffbea51082a326bd758190b88f970b092b80202f4e"}
{"level":"debug","ts":"2026-07-12T20:02:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4afefd3ea4bcea72b642967721e8293dc2fb652f59e72794957c6b28b47587cc","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:02:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4afefd3ea4bcea72b642967721e8293dc2fb652f59e72794957c6b28b47587cc"}
{"level":"debug","ts":"2026-07-12T20:02:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d687df711b0f7d675202d76da80c71a5214ed84e3f20e330483d262ed723d0b5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/d687df711b0f7d675202d76da80c71a5214ed84e3f20e330483d262ed723d0b5","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:02:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b2027e0b5bf7cc35ce10e8ab11c1540c7477a9a03bcf1dcbf76c77452fa6c2b6","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:02:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d687df711b0f7d675202d76da80c71a5214ed84e3f20e330483d262ed723d0b5"}
{"level":"debug","ts":"2026-07-12T20:02:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/b2027e0b5bf7cc35ce10e8ab11c1540c7477a9a03bcf1dcbf76c77452fa6c2b6","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:02:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"55716d53519a2168a89de10a7c7208d702cd8957aa3c2802e28d04885fb83bdf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"bb35e0d4b17b4d5ca1ae4cb730c86731ab4c4e07e02af1c64671f9a8c4c16868","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:02:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b2027e0b5bf7cc35ce10e8ab11c1540c7477a9a03bcf1dcbf76c77452fa6c2b6"}
{"level":"debug","ts":"2026-07-12T20:02:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/55716d53519a2168a89de10a7c7208d702cd8957aa3c2802e28d04885fb83bdf","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:02:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/55716d53519a2168a89de10a7c7208d702cd8957aa3c2802e28d04885fb83bdf"}
{"level":"debug","ts":"2026-07-12T20:02:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/bb35e0d4b17b4d5ca1ae4cb730c86731ab4c4e07e02af1c64671f9a8c4c16868","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:02:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b8efafc31b6416bc2a9bedf366ecde25c30fa30b41e33922bdcfb8f1a9e8be15","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:02:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bb35e0d4b17b4d5ca1ae4cb730c86731ab4c4e07e02af1c64671f9a8c4c16868"}
{"level":"debug","ts":"2026-07-12T20:02:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/b8efafc31b6416bc2a9bedf366ecde25c30fa30b41e33922bdcfb8f1a9e8be15","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:02:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"95014eebbc08a3a479e2bc1cff1a419e9d3051f2a828516f4eaa1e1abc819601","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:02:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b8efafc31b6416bc2a9bedf366ecde25c30fa30b41e33922bdcfb8f1a9e8be15"}
{"level":"debug","ts":"2026-07-12T20:02:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4c00f298f9197cfe1b0ccafae219eae9ca99cf8a4838542b4a1620760b1bbea3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T20:02:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/95014eebbc08a3a479e2bc1cff1a419e9d3051f2a828516f4eaa1e1abc819601","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:02:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4ba261fd3c3c7a2a194bb9fae3ac72c27be7d1a7f9fb8cec904f57d17b69af09","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T20:02:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/95014eebbc08a3a479e2bc1cff1a419e9d3051f2a828516f4eaa1e1abc819601"}
{"level":"debug","ts":"2026-07-12T20:02:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4c00f298f9197cfe1b0ccafae219eae9ca99cf8a4838542b4a1620760b1bbea3","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:02:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4c00f298f9197cfe1b0ccafae219eae9ca99cf8a4838542b4a1620760b1bbea3"}
{"level":"debug","ts":"2026-07-12T20:02:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4ba261fd3c3c7a2a194bb9fae3ac72c27be7d1a7f9fb8cec904f57d17b69af09","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:02:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4ba261fd3c3c7a2a194bb9fae3ac72c27be7d1a7f9fb8cec904f57d17b69af09"}
{"level":"info","ts":"2026-07-12T20:02:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"57725a4a-817f-4dd5-9402-e9fe8177d8d5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:52594","PortSpecifier":{"PortValue":52594}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.37:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"57725a4a-817f-4dd5-9402-e9fe8177d8d5","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-e68438.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T20:02:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"57725a4a-817f-4dd5-9402-e9fe8177d8d5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:52594","PortSpecifier":{"PortValue":52594}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.37:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783886552,"nanos":296672490},"http":{"id":"57725a4a-817f-4dd5-9402-e9fe8177d8d5","method":"POST","headers":{":authority":"e2e-shared-a-e68438.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T20:02:32Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"57725a4a-817f-4dd5-9402-e9fe8177d8d5","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-12T20:02:32Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"57725a4a-817f-4dd5-9402-e9fe8177d8d5","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-12T20:02:32Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"57725a4a-817f-4dd5-9402-e9fe8177d8d5","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"f539f6ce-054a-47a2-a0ef-54f768a351e3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=fc3bc2b6-ad40-4d2c-9c7e-ac1c58cf971d"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/b1708c845c3c"]}}
{"level":"debug","ts":"2026-07-12T20:02:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"57725a4a-817f-4dd5-9402-e9fe8177d8d5","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/b1708c845c3c"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=fc3bc2b6-ad40-4d2c-9c7e-ac1c58cf971d"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"f539f6ce-054a-47a2-a0ef-54f768a351e3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"ee6fe41741d318ef9a23db979185da67e66f4ff7b4ced5159dd8a35df3c98c27"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.37:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-e68438.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T20:02:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"57725a4a-817f-4dd5-9402-e9fe8177d8d5","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:02:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"57725a4a-817f-4dd5-9402-e9fe8177d8d5","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:02:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"57725a4a-817f-4dd5-9402-e9fe8177d8d5","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e68438/rate-test-model-e68438\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:02:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"57725a4a-817f-4dd5-9402-e9fe8177d8d5","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-12T20:02:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"57725a4a-817f-4dd5-9402-e9fe8177d8d5","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-12T20:02:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"57725a4a-817f-4dd5-9402-e9fe8177d8d5","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-12T20:02:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"57725a4a-817f-4dd5-9402-e9fe8177d8d5","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T20:02:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"57725a4a-817f-4dd5-9402-e9fe8177d8d5","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T20:02:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e8aa5acb-a34b-451a-a613-efe95807cffb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:51986","PortSpecifier":{"PortValue":51986}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.63:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e8aa5acb-a34b-451a-a613-efe95807cffb","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-5865e5.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T20:02:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e8aa5acb-a34b-451a-a613-efe95807cffb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:51986","PortSpecifier":{"PortValue":51986}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.63:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783886552,"nanos":341597490},"http":{"id":"e8aa5acb-a34b-451a-a613-efe95807cffb","method":"POST","headers":{":authority":"e2e-shared-b-5865e5.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T20:02:32Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"e8aa5acb-a34b-451a-a613-efe95807cffb","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-12T20:02:32Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"e8aa5acb-a34b-451a-a613-efe95807cffb","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-12T20:02:32Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e8aa5acb-a34b-451a-a613-efe95807cffb","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"f539f6ce-054a-47a2-a0ef-54f768a351e3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=fc3bc2b6-ad40-4d2c-9c7e-ac1c58cf971d"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/b1708c845c3c"]}}
{"level":"debug","ts":"2026-07-12T20:02:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e8aa5acb-a34b-451a-a613-efe95807cffb","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/b1708c845c3c"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=fc3bc2b6-ad40-4d2c-9c7e-ac1c58cf971d"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"f539f6ce-054a-47a2-a0ef-54f768a351e3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b8efafc31b6416bc2a9bedf366ecde25c30fa30b41e33922bdcfb8f1a9e8be15"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.63:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-5865e5.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T20:02:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e8aa5acb-a34b-451a-a613-efe95807cffb","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:02:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e8aa5acb-a34b-451a-a613-efe95807cffb","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:02:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e8aa5acb-a34b-451a-a613-efe95807cffb","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-5865e5/rate-test-model-5865e5\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:02:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"e8aa5acb-a34b-451a-a613-efe95807cffb","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-12T20:02:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e8aa5acb-a34b-451a-a613-efe95807cffb","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-12T20:02:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e8aa5acb-a34b-451a-a613-efe95807cffb","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-12T20:02:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e8aa5acb-a34b-451a-a613-efe95807cffb","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T20:02:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e8aa5acb-a34b-451a-a613-efe95807cffb","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T20:02:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c5b6415e-1f14-48a0-ad30-50064a038dcb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:52600","PortSpecifier":{"PortValue":52600}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.37:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c5b6415e-1f14-48a0-ad30-50064a038dcb","method":"POST","path":"/ai-tenant-e2e-shared-a-e68438/rate-test-model-e68438/v1/completions","host":"e2e-shared-a-e68438.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T20:02:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c5b6415e-1f14-48a0-ad30-50064a038dcb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:52600","PortSpecifier":{"PortValue":52600}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.37:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783886552,"nanos":383454702},"http":{"id":"c5b6415e-1f14-48a0-ad30-50064a038dcb","method":"POST","headers":{":authority":"e2e-shared-a-e68438.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-e68438/rate-test-model-e68438/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T20:02:32Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"c5b6415e-1f14-48a0-ad30-50064a038dcb","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-ctQYo8byRxHkZcih_hmZFUgPsu00FFs9SzrY4jQS8xgJ3wNDc20GO0zIdn3B"}
{"level":"debug","ts":"2026-07-12T20:02:32Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c5b6415e-1f14-48a0-ad30-50064a038dcb","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-e68438.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-ctQYo8byRxHkZcih_hmZFUgPsu00FFs9SzrY4jQS8xgJ3wNDc20GO0zIdn3B\"}"}
{"level":"debug","ts":"2026-07-12T20:02:32Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c5b6415e-1f14-48a0-ad30-50064a038dcb","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e68438.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"12730769-8039-4c7f-852f-ead99a50eaaa","keyName":"e2e-rate-a-4f6df6","subscription":"e2e-rate-iso-a-4f6df6","tenant":"e2e-shared-a-e68438","userId":"12730769-8039-4c7f-852f-ead99a50eaaa","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-12T20:02:32Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c5b6415e-1f14-48a0-ad30-50064a038dcb","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-e68438.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-e68438/rate-test-model-e68438\",\"requestedSubscription\":\"e2e-rate-iso-a-4f6df6\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-12T20:02:32Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c5b6415e-1f14-48a0-ad30-50064a038dcb","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e68438.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-e68438","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-4f6df6","namespace":"ai-tenant-e2e-shared-a-e68438","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-12T20:02:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"c5b6415e-1f14-48a0-ad30-50064a038dcb","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T20:02:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c5b6415e-1f14-48a0-ad30-50064a038dcb","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:02:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c5b6415e-1f14-48a0-ad30-50064a038dcb","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:02:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c5b6415e-1f14-48a0-ad30-50064a038dcb","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e68438/rate-test-model-e68438\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:02:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c5b6415e-1f14-48a0-ad30-50064a038dcb","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:02:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c5b6415e-1f14-48a0-ad30-50064a038dcb","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-4f6df6"}
{"level":"debug","ts":"2026-07-12T20:02:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c5b6415e-1f14-48a0-ad30-50064a038dcb","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-12T20:02:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c5b6415e-1f14-48a0-ad30-50064a038dcb","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-12T20:02:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c5b6415e-1f14-48a0-ad30-50064a038dcb","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"12730769-8039-4c7f-852f-ead99a50eaaa","keyName":"e2e-rate-a-4f6df6","selected_subscription":"e2e-rate-iso-a-4f6df6","selected_subscription_key":"ai-tenant-e2e-shared-a-e68438/e2e-rate-iso-a-4f6df6@ai-tenant-e2e-shared-a-e68438/rate-test-model-e68438","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-e68438","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-4f6df6","namespace":"ai-tenant-e2e-shared-a-e68438","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-12T20:02:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c5b6415e-1f14-48a0-ad30-50064a038dcb","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T20:02:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c5b6415e-1f14-48a0-ad30-50064a038dcb","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T20:02:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"26ecb99e-7450-4b3d-aaec-5643d5b483db","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:52608","PortSpecifier":{"PortValue":52608}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.37:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"26ecb99e-7450-4b3d-aaec-5643d5b483db","method":"POST","path":"/ai-tenant-e2e-shared-a-e68438/rate-test-model-e68438/v1/completions","host":"e2e-shared-a-e68438.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T20:02:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"26ecb99e-7450-4b3d-aaec-5643d5b483db","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:52608","PortSpecifier":{"PortValue":52608}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.37:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783886553,"nanos":442429654},"http":{"id":"26ecb99e-7450-4b3d-aaec-5643d5b483db","method":"POST","headers":{":authority":"e2e-shared-a-e68438.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-e68438/rate-test-model-e68438/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T20:02:33Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"26ecb99e-7450-4b3d-aaec-5643d5b483db","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-ctQYo8byRxHkZcih_hmZFUgPsu00FFs9SzrY4jQS8xgJ3wNDc20GO0zIdn3B"}
{"level":"debug","ts":"2026-07-12T20:02:33Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"26ecb99e-7450-4b3d-aaec-5643d5b483db","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-e68438.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-ctQYo8byRxHkZcih_hmZFUgPsu00FFs9SzrY4jQS8xgJ3wNDc20GO0zIdn3B\"}"}
{"level":"debug","ts":"2026-07-12T20:02:33Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"26ecb99e-7450-4b3d-aaec-5643d5b483db","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e68438.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"12730769-8039-4c7f-852f-ead99a50eaaa","keyName":"e2e-rate-a-4f6df6","subscription":"e2e-rate-iso-a-4f6df6","tenant":"e2e-shared-a-e68438","userId":"12730769-8039-4c7f-852f-ead99a50eaaa","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-12T20:02:33Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"26ecb99e-7450-4b3d-aaec-5643d5b483db","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-e68438.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-e68438/rate-test-model-e68438\",\"requestedSubscription\":\"e2e-rate-iso-a-4f6df6\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-12T20:02:33Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"26ecb99e-7450-4b3d-aaec-5643d5b483db","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e68438.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-e68438","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-4f6df6","namespace":"ai-tenant-e2e-shared-a-e68438","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-12T20:02:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"26ecb99e-7450-4b3d-aaec-5643d5b483db","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T20:02:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"26ecb99e-7450-4b3d-aaec-5643d5b483db","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:02:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"26ecb99e-7450-4b3d-aaec-5643d5b483db","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:02:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"26ecb99e-7450-4b3d-aaec-5643d5b483db","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e68438/rate-test-model-e68438\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:02:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"26ecb99e-7450-4b3d-aaec-5643d5b483db","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:02:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"26ecb99e-7450-4b3d-aaec-5643d5b483db","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-4f6df6"}
{"level":"debug","ts":"2026-07-12T20:02:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"26ecb99e-7450-4b3d-aaec-5643d5b483db","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-12T20:02:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"26ecb99e-7450-4b3d-aaec-5643d5b483db","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-12T20:02:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"26ecb99e-7450-4b3d-aaec-5643d5b483db","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"12730769-8039-4c7f-852f-ead99a50eaaa","keyName":"e2e-rate-a-4f6df6","selected_subscription":"e2e-rate-iso-a-4f6df6","selected_subscription_key":"ai-tenant-e2e-shared-a-e68438/e2e-rate-iso-a-4f6df6@ai-tenant-e2e-shared-a-e68438/rate-test-model-e68438","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-e68438","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-4f6df6","namespace":"ai-tenant-e2e-shared-a-e68438","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-12T20:02:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"26ecb99e-7450-4b3d-aaec-5643d5b483db","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T20:02:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"26ecb99e-7450-4b3d-aaec-5643d5b483db","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T20:02:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b7588d03-dad3-4188-8453-7fa210d58ef8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:52612","PortSpecifier":{"PortValue":52612}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.37:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b7588d03-dad3-4188-8453-7fa210d58ef8","method":"POST","path":"/ai-tenant-e2e-shared-a-e68438/rate-test-model-e68438/v1/completions","host":"e2e-shared-a-e68438.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T20:02:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b7588d03-dad3-4188-8453-7fa210d58ef8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:52612","PortSpecifier":{"PortValue":52612}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.37:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783886554,"nanos":482190129},"http":{"id":"b7588d03-dad3-4188-8453-7fa210d58ef8","method":"POST","headers":{":authority":"e2e-shared-a-e68438.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-e68438/rate-test-model-e68438/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T20:02:34Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b7588d03-dad3-4188-8453-7fa210d58ef8","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-ctQYo8byRxHkZcih_hmZFUgPsu00FFs9SzrY4jQS8xgJ3wNDc20GO0zIdn3B"}
{"level":"debug","ts":"2026-07-12T20:02:34Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b7588d03-dad3-4188-8453-7fa210d58ef8","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-e68438.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-ctQYo8byRxHkZcih_hmZFUgPsu00FFs9SzrY4jQS8xgJ3wNDc20GO0zIdn3B\"}"}
{"level":"debug","ts":"2026-07-12T20:02:34Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b7588d03-dad3-4188-8453-7fa210d58ef8","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e68438.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"12730769-8039-4c7f-852f-ead99a50eaaa","keyName":"e2e-rate-a-4f6df6","subscription":"e2e-rate-iso-a-4f6df6","tenant":"e2e-shared-a-e68438","userId":"12730769-8039-4c7f-852f-ead99a50eaaa","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-12T20:02:34Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b7588d03-dad3-4188-8453-7fa210d58ef8","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-e68438.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-e68438/rate-test-model-e68438\",\"requestedSubscription\":\"e2e-rate-iso-a-4f6df6\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-12T20:02:34Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b7588d03-dad3-4188-8453-7fa210d58ef8","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e68438.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-e68438","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-4f6df6","namespace":"ai-tenant-e2e-shared-a-e68438","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-12T20:02:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b7588d03-dad3-4188-8453-7fa210d58ef8","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T20:02:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b7588d03-dad3-4188-8453-7fa210d58ef8","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:02:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b7588d03-dad3-4188-8453-7fa210d58ef8","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:02:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b7588d03-dad3-4188-8453-7fa210d58ef8","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:02:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b7588d03-dad3-4188-8453-7fa210d58ef8","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e68438/rate-test-model-e68438\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:02:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b7588d03-dad3-4188-8453-7fa210d58ef8","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-12T20:02:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b7588d03-dad3-4188-8453-7fa210d58ef8","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-12T20:02:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b7588d03-dad3-4188-8453-7fa210d58ef8","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-4f6df6"}
{"level":"debug","ts":"2026-07-12T20:02:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b7588d03-dad3-4188-8453-7fa210d58ef8","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"12730769-8039-4c7f-852f-ead99a50eaaa","keyName":"e2e-rate-a-4f6df6","selected_subscription":"e2e-rate-iso-a-4f6df6","selected_subscription_key":"ai-tenant-e2e-shared-a-e68438/e2e-rate-iso-a-4f6df6@ai-tenant-e2e-shared-a-e68438/rate-test-model-e68438","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-e68438","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-4f6df6","namespace":"ai-tenant-e2e-shared-a-e68438","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-12T20:02:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b7588d03-dad3-4188-8453-7fa210d58ef8","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T20:02:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b7588d03-dad3-4188-8453-7fa210d58ef8","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T20:02:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a3fef20d-0347-4b57-bc63-f760581e1c60","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:51440","PortSpecifier":{"PortValue":51440}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.37:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a3fef20d-0347-4b57-bc63-f760581e1c60","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-e68438.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T20:02:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a3fef20d-0347-4b57-bc63-f760581e1c60","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:51440","PortSpecifier":{"PortValue":51440}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.37:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783886565,"nanos":170555131},"http":{"id":"a3fef20d-0347-4b57-bc63-f760581e1c60","method":"POST","headers":{":authority":"e2e-shared-a-e68438.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T20:02:45Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"a3fef20d-0347-4b57-bc63-f760581e1c60","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-12T20:02:45Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"a3fef20d-0347-4b57-bc63-f760581e1c60","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-12T20:02:45Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a3fef20d-0347-4b57-bc63-f760581e1c60","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"f539f6ce-054a-47a2-a0ef-54f768a351e3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=fc3bc2b6-ad40-4d2c-9c7e-ac1c58cf971d"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/b1708c845c3c"]}}
{"level":"debug","ts":"2026-07-12T20:02:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a3fef20d-0347-4b57-bc63-f760581e1c60","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/b1708c845c3c"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=fc3bc2b6-ad40-4d2c-9c7e-ac1c58cf971d"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"f539f6ce-054a-47a2-a0ef-54f768a351e3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"ee6fe41741d318ef9a23db979185da67e66f4ff7b4ced5159dd8a35df3c98c27"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.37:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-e68438.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T20:02:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a3fef20d-0347-4b57-bc63-f760581e1c60","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:02:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a3fef20d-0347-4b57-bc63-f760581e1c60","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:02:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a3fef20d-0347-4b57-bc63-f760581e1c60","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e68438/rate-test-model-e68438\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:02:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"a3fef20d-0347-4b57-bc63-f760581e1c60","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-12T20:02:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a3fef20d-0347-4b57-bc63-f760581e1c60","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-12T20:02:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a3fef20d-0347-4b57-bc63-f760581e1c60","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-12T20:02:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a3fef20d-0347-4b57-bc63-f760581e1c60","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T20:02:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a3fef20d-0347-4b57-bc63-f760581e1c60","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T20:02:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a63515da-b396-4fd7-bf9b-a4438eb41d78","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:43346","PortSpecifier":{"PortValue":43346}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.63:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a63515da-b396-4fd7-bf9b-a4438eb41d78","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-5865e5.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T20:02:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a63515da-b396-4fd7-bf9b-a4438eb41d78","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:43346","PortSpecifier":{"PortValue":43346}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.63:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783886565,"nanos":216291547},"http":{"id":"a63515da-b396-4fd7-bf9b-a4438eb41d78","method":"POST","headers":{":authority":"e2e-shared-b-5865e5.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T20:02:45Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"a63515da-b396-4fd7-bf9b-a4438eb41d78","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-12T20:02:45Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"a63515da-b396-4fd7-bf9b-a4438eb41d78","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-12T20:02:45Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a63515da-b396-4fd7-bf9b-a4438eb41d78","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"f539f6ce-054a-47a2-a0ef-54f768a351e3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=fc3bc2b6-ad40-4d2c-9c7e-ac1c58cf971d"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/b1708c845c3c"]}}
{"level":"debug","ts":"2026-07-12T20:02:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a63515da-b396-4fd7-bf9b-a4438eb41d78","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/b1708c845c3c"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=fc3bc2b6-ad40-4d2c-9c7e-ac1c58cf971d"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"f539f6ce-054a-47a2-a0ef-54f768a351e3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b8efafc31b6416bc2a9bedf366ecde25c30fa30b41e33922bdcfb8f1a9e8be15"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.63:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-5865e5.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T20:02:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a63515da-b396-4fd7-bf9b-a4438eb41d78","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:02:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a63515da-b396-4fd7-bf9b-a4438eb41d78","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:02:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a63515da-b396-4fd7-bf9b-a4438eb41d78","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-5865e5/rate-test-model-5865e5\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:02:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"a63515da-b396-4fd7-bf9b-a4438eb41d78","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-12T20:02:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a63515da-b396-4fd7-bf9b-a4438eb41d78","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-12T20:02:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a63515da-b396-4fd7-bf9b-a4438eb41d78","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-12T20:02:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a63515da-b396-4fd7-bf9b-a4438eb41d78","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T20:02:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a63515da-b396-4fd7-bf9b-a4438eb41d78","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T20:02:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fef542cc-9082-4f09-970b-181d7962fb46","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:51450","PortSpecifier":{"PortValue":51450}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.37:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"fef542cc-9082-4f09-970b-181d7962fb46","method":"POST","path":"/ai-tenant-e2e-shared-a-e68438/rate-test-model-e68438/v1/completions","host":"e2e-shared-a-e68438.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T20:02:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fef542cc-9082-4f09-970b-181d7962fb46","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:51450","PortSpecifier":{"PortValue":51450}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.37:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783886565,"nanos":252435781},"http":{"id":"fef542cc-9082-4f09-970b-181d7962fb46","method":"POST","headers":{":authority":"e2e-shared-a-e68438.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-e68438/rate-test-model-e68438/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T20:02:45Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"fef542cc-9082-4f09-970b-181d7962fb46","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-18123neywBeKeYYfM_kBcFQ2FFeYs9j8fze3ur2wbPuIL8hz5Xv8zHQeJdRy4"}
{"level":"debug","ts":"2026-07-12T20:02:45Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"fef542cc-9082-4f09-970b-181d7962fb46","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-e68438.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-18123neywBeKeYYfM_kBcFQ2FFeYs9j8fze3ur2wbPuIL8hz5Xv8zHQeJdRy4\"}"}
{"level":"debug","ts":"2026-07-12T20:02:45Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"fef542cc-9082-4f09-970b-181d7962fb46","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e68438.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"c12e0337-6918-455e-84ec-07bf9053a507","keyName":"e2e-rate-a-4438ba","subscription":"e2e-rate-iso-a-4438ba","tenant":"e2e-shared-a-e68438","userId":"c12e0337-6918-455e-84ec-07bf9053a507","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-12T20:02:45Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"fef542cc-9082-4f09-970b-181d7962fb46","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-e68438.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-e68438/rate-test-model-e68438\",\"requestedSubscription\":\"e2e-rate-iso-a-4438ba\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-12T20:02:45Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"fef542cc-9082-4f09-970b-181d7962fb46","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e68438.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-e68438","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-4438ba","namespace":"ai-tenant-e2e-shared-a-e68438","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-12T20:02:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"fef542cc-9082-4f09-970b-181d7962fb46","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T20:02:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fef542cc-9082-4f09-970b-181d7962fb46","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:02:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fef542cc-9082-4f09-970b-181d7962fb46","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:02:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fef542cc-9082-4f09-970b-181d7962fb46","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:02:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fef542cc-9082-4f09-970b-181d7962fb46","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e68438/rate-test-model-e68438\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:02:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fef542cc-9082-4f09-970b-181d7962fb46","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-12T20:02:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fef542cc-9082-4f09-970b-181d7962fb46","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-4438ba"}
{"level":"debug","ts":"2026-07-12T20:02:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fef542cc-9082-4f09-970b-181d7962fb46","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-12T20:02:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fef542cc-9082-4f09-970b-181d7962fb46","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"c12e0337-6918-455e-84ec-07bf9053a507","keyName":"e2e-rate-a-4438ba","selected_subscription":"e2e-rate-iso-a-4438ba","selected_subscription_key":"ai-tenant-e2e-shared-a-e68438/e2e-rate-iso-a-4438ba@ai-tenant-e2e-shared-a-e68438/rate-test-model-e68438","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-e68438","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-4438ba","namespace":"ai-tenant-e2e-shared-a-e68438","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-12T20:02:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fef542cc-9082-4f09-970b-181d7962fb46","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T20:02:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fef542cc-9082-4f09-970b-181d7962fb46","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T20:02:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5015758e-b8dc-45c8-b404-1fd9d67ee50d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:51454","PortSpecifier":{"PortValue":51454}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.37:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5015758e-b8dc-45c8-b404-1fd9d67ee50d","method":"POST","path":"/ai-tenant-e2e-shared-a-e68438/rate-test-model-e68438/v1/completions","host":"e2e-shared-a-e68438.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T20:02:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5015758e-b8dc-45c8-b404-1fd9d67ee50d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:51454","PortSpecifier":{"PortValue":51454}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.37:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783886566,"nanos":299563171},"http":{"id":"5015758e-b8dc-45c8-b404-1fd9d67ee50d","method":"POST","headers":{":authority":"e2e-shared-a-e68438.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-e68438/rate-test-model-e68438/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T20:02:46Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5015758e-b8dc-45c8-b404-1fd9d67ee50d","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-18123neywBeKeYYfM_kBcFQ2FFeYs9j8fze3ur2wbPuIL8hz5Xv8zHQeJdRy4"}
{"level":"debug","ts":"2026-07-12T20:02:46Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5015758e-b8dc-45c8-b404-1fd9d67ee50d","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-e68438.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-18123neywBeKeYYfM_kBcFQ2FFeYs9j8fze3ur2wbPuIL8hz5Xv8zHQeJdRy4\"}"}
{"level":"debug","ts":"2026-07-12T20:02:46Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5015758e-b8dc-45c8-b404-1fd9d67ee50d","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e68438.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"c12e0337-6918-455e-84ec-07bf9053a507","keyName":"e2e-rate-a-4438ba","subscription":"e2e-rate-iso-a-4438ba","tenant":"e2e-shared-a-e68438","userId":"c12e0337-6918-455e-84ec-07bf9053a507","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-12T20:02:46Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5015758e-b8dc-45c8-b404-1fd9d67ee50d","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-e68438.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-e68438/rate-test-model-e68438\",\"requestedSubscription\":\"e2e-rate-iso-a-4438ba\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-12T20:02:46Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5015758e-b8dc-45c8-b404-1fd9d67ee50d","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e68438.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-e68438","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-4438ba","namespace":"ai-tenant-e2e-shared-a-e68438","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-12T20:02:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5015758e-b8dc-45c8-b404-1fd9d67ee50d","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T20:02:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5015758e-b8dc-45c8-b404-1fd9d67ee50d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:02:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5015758e-b8dc-45c8-b404-1fd9d67ee50d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:02:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5015758e-b8dc-45c8-b404-1fd9d67ee50d","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:02:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5015758e-b8dc-45c8-b404-1fd9d67ee50d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e68438/rate-test-model-e68438\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:02:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5015758e-b8dc-45c8-b404-1fd9d67ee50d","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-12T20:02:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5015758e-b8dc-45c8-b404-1fd9d67ee50d","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-4438ba"}
{"level":"debug","ts":"2026-07-12T20:02:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5015758e-b8dc-45c8-b404-1fd9d67ee50d","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-12T20:02:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5015758e-b8dc-45c8-b404-1fd9d67ee50d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"c12e0337-6918-455e-84ec-07bf9053a507","keyName":"e2e-rate-a-4438ba","selected_subscription":"e2e-rate-iso-a-4438ba","selected_subscription_key":"ai-tenant-e2e-shared-a-e68438/e2e-rate-iso-a-4438ba@ai-tenant-e2e-shared-a-e68438/rate-test-model-e68438","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-e68438","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-4438ba","namespace":"ai-tenant-e2e-shared-a-e68438","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-12T20:02:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5015758e-b8dc-45c8-b404-1fd9d67ee50d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T20:02:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5015758e-b8dc-45c8-b404-1fd9d67ee50d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T20:02:47Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ef4c4f79-292f-49e4-92c5-0551ff86fe8e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:51460","PortSpecifier":{"PortValue":51460}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.37:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ef4c4f79-292f-49e4-92c5-0551ff86fe8e","method":"POST","path":"/ai-tenant-e2e-shared-a-e68438/rate-test-model-e68438/v1/completions","host":"e2e-shared-a-e68438.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T20:02:47Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ef4c4f79-292f-49e4-92c5-0551ff86fe8e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:51460","PortSpecifier":{"PortValue":51460}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.37:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783886567,"nanos":336005608},"http":{"id":"ef4c4f79-292f-49e4-92c5-0551ff86fe8e","method":"POST","headers":{":authority":"e2e-shared-a-e68438.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-e68438/rate-test-model-e68438/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T20:02:47Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ef4c4f79-292f-49e4-92c5-0551ff86fe8e","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-18123neywBeKeYYfM_kBcFQ2FFeYs9j8fze3ur2wbPuIL8hz5Xv8zHQeJdRy4"}
{"level":"debug","ts":"2026-07-12T20:02:47Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ef4c4f79-292f-49e4-92c5-0551ff86fe8e","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-e68438.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-18123neywBeKeYYfM_kBcFQ2FFeYs9j8fze3ur2wbPuIL8hz5Xv8zHQeJdRy4\"}"}
{"level":"debug","ts":"2026-07-12T20:02:47Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ef4c4f79-292f-49e4-92c5-0551ff86fe8e","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e68438.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"c12e0337-6918-455e-84ec-07bf9053a507","keyName":"e2e-rate-a-4438ba","subscription":"e2e-rate-iso-a-4438ba","tenant":"e2e-shared-a-e68438","userId":"c12e0337-6918-455e-84ec-07bf9053a507","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-12T20:02:47Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ef4c4f79-292f-49e4-92c5-0551ff86fe8e","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-e68438.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-e68438/rate-test-model-e68438\",\"requestedSubscription\":\"e2e-rate-iso-a-4438ba\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-12T20:02:47Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ef4c4f79-292f-49e4-92c5-0551ff86fe8e","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e68438.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-e68438","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-4438ba","namespace":"ai-tenant-e2e-shared-a-e68438","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-12T20:02:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ef4c4f79-292f-49e4-92c5-0551ff86fe8e","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T20:02:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ef4c4f79-292f-49e4-92c5-0551ff86fe8e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:02:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ef4c4f79-292f-49e4-92c5-0551ff86fe8e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:02:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ef4c4f79-292f-49e4-92c5-0551ff86fe8e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e68438/rate-test-model-e68438\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:02:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ef4c4f79-292f-49e4-92c5-0551ff86fe8e","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:02:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ef4c4f79-292f-49e4-92c5-0551ff86fe8e","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-12T20:02:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ef4c4f79-292f-49e4-92c5-0551ff86fe8e","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-12T20:02:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ef4c4f79-292f-49e4-92c5-0551ff86fe8e","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-4438ba"}
{"level":"debug","ts":"2026-07-12T20:02:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ef4c4f79-292f-49e4-92c5-0551ff86fe8e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"c12e0337-6918-455e-84ec-07bf9053a507","keyName":"e2e-rate-a-4438ba","selected_subscription":"e2e-rate-iso-a-4438ba","selected_subscription_key":"ai-tenant-e2e-shared-a-e68438/e2e-rate-iso-a-4438ba@ai-tenant-e2e-shared-a-e68438/rate-test-model-e68438","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-e68438","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-4438ba","namespace":"ai-tenant-e2e-shared-a-e68438","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-12T20:02:47Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ef4c4f79-292f-49e4-92c5-0551ff86fe8e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T20:02:47Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ef4c4f79-292f-49e4-92c5-0551ff86fe8e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T20:02:47Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7e8f579d-e424-4769-b410-5fce39a7bc03","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:43354","PortSpecifier":{"PortValue":43354}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.63:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"7e8f579d-e424-4769-b410-5fce39a7bc03","method":"POST","path":"/ai-tenant-e2e-shared-b-5865e5/rate-test-model-5865e5/v1/completions","host":"e2e-shared-b-5865e5.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T20:02:47Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7e8f579d-e424-4769-b410-5fce39a7bc03","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:43354","PortSpecifier":{"PortValue":43354}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.63:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783886567,"nanos":372127265},"http":{"id":"7e8f579d-e424-4769-b410-5fce39a7bc03","method":"POST","headers":{":authority":"e2e-shared-b-5865e5.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-5865e5/rate-test-model-5865e5/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T20:02:47Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"7e8f579d-e424-4769-b410-5fce39a7bc03","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-18QfXhv4YorYONWty_l75gt2PTVwuRf3LhsZd0K08nCgk4V09hkGogMxEdq7c"}
{"level":"debug","ts":"2026-07-12T20:02:47Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"7e8f579d-e424-4769-b410-5fce39a7bc03","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-5865e5.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-18QfXhv4YorYONWty_l75gt2PTVwuRf3LhsZd0K08nCgk4V09hkGogMxEdq7c\"}"}
{"level":"debug","ts":"2026-07-12T20:02:47Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"7e8f579d-e424-4769-b410-5fce39a7bc03","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-5865e5.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"cc63fb20-767a-4b49-a9e6-05d4cb693a6e","keyName":"e2e-rate-b-4438ba","subscription":"e2e-rate-iso-b-4438ba","tenant":"e2e-shared-b-5865e5","userId":"cc63fb20-767a-4b49-a9e6-05d4cb693a6e","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-12T20:02:47Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"7e8f579d-e424-4769-b410-5fce39a7bc03","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-5865e5.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-5865e5/rate-test-model-5865e5\",\"requestedSubscription\":\"e2e-rate-iso-b-4438ba\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-12T20:02:47Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"7e8f579d-e424-4769-b410-5fce39a7bc03","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-5865e5.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-5865e5","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-4438ba","namespace":"ai-tenant-e2e-shared-b-5865e5","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-12T20:02:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"7e8f579d-e424-4769-b410-5fce39a7bc03","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T20:02:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7e8f579d-e424-4769-b410-5fce39a7bc03","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:02:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7e8f579d-e424-4769-b410-5fce39a7bc03","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:02:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7e8f579d-e424-4769-b410-5fce39a7bc03","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-5865e5/rate-test-model-5865e5\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:02:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7e8f579d-e424-4769-b410-5fce39a7bc03","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:02:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7e8f579d-e424-4769-b410-5fce39a7bc03","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"cc63fb20-767a-4b49-a9e6-05d4cb693a6e","keyName":"e2e-rate-b-4438ba","selected_subscription":"e2e-rate-iso-b-4438ba","selected_subscription_key":"ai-tenant-e2e-shared-b-5865e5/e2e-rate-iso-b-4438ba@ai-tenant-e2e-shared-b-5865e5/rate-test-model-5865e5","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-5865e5","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-4438ba","namespace":"ai-tenant-e2e-shared-b-5865e5","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"debug","ts":"2026-07-12T20:02:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7e8f579d-e424-4769-b410-5fce39a7bc03","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-12T20:02:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7e8f579d-e424-4769-b410-5fce39a7bc03","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-4438ba"}
{"level":"debug","ts":"2026-07-12T20:02:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7e8f579d-e424-4769-b410-5fce39a7bc03","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-12T20:02:47Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7e8f579d-e424-4769-b410-5fce39a7bc03","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T20:02:47Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7e8f579d-e424-4769-b410-5fce39a7bc03","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T20:02:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"59c64482-6a12-4c41-9a3f-7e313d2043db","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:49294","PortSpecifier":{"PortValue":49294}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.42:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"59c64482-6a12-4c41-9a3f-7e313d2043db","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T20:02:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"59c64482-6a12-4c41-9a3f-7e313d2043db","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:49294","PortSpecifier":{"PortValue":49294}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.42:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783886570,"nanos":424134178},"http":{"id":"59c64482-6a12-4c41-9a3f-7e313d2043db","method":"POST","headers":{":authority":"maas.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T20:02:50Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"59c64482-6a12-4c41-9a3f-7e313d2043db","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783886630,"groups":["Engineering","Project-Alpha"],"iat":1783886570,"iss":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:f2c0196d-1254-3e9a-068c-56bf5d36b917","preferred_username":"alice_lead","scope":"profile email","sid":"uAqwj6CrRAvXsxrtpRpyL8Lu","sub":"b7cdd126-8752-41c3-add9-49abc1639715","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-12T20:02:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"59c64482-6a12-4c41-9a3f-7e313d2043db","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783886630,"groups":["Engineering","Project-Alpha"],"iat":1783886570,"iss":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:f2c0196d-1254-3e9a-068c-56bf5d36b917","preferred_username":"alice_lead","scope":"profile email","sid":"uAqwj6CrRAvXsxrtpRpyL8Lu","sub":"b7cdd126-8752-41c3-add9-49abc1639715","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.42:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T20:02:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"59c64482-6a12-4c41-9a3f-7e313d2043db","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:02:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"59c64482-6a12-4c41-9a3f-7e313d2043db","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:02:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"59c64482-6a12-4c41-9a3f-7e313d2043db","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:02:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"59c64482-6a12-4c41-9a3f-7e313d2043db","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:02:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"59c64482-6a12-4c41-9a3f-7e313d2043db","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-12T20:02:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"59c64482-6a12-4c41-9a3f-7e313d2043db","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-12T20:02:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"59c64482-6a12-4c41-9a3f-7e313d2043db","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-12T20:02:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"59c64482-6a12-4c41-9a3f-7e313d2043db","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T20:02:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"59c64482-6a12-4c41-9a3f-7e313d2043db","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T20:02:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1401fa1a-440e-490f-b9f0-8af2784cce74","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:49308","PortSpecifier":{"PortValue":49308}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.42:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1401fa1a-440e-490f-b9f0-8af2784cce74","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T20:02:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1401fa1a-440e-490f-b9f0-8af2784cce74","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:49308","PortSpecifier":{"PortValue":49308}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.42:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783886570,"nanos":535519781},"http":{"id":"1401fa1a-440e-490f-b9f0-8af2784cce74","method":"POST","headers":{":authority":"maas.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T20:02:50Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"1401fa1a-440e-490f-b9f0-8af2784cce74","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-12T20:02:50Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"1401fa1a-440e-490f-b9f0-8af2784cce74","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-12T20:02:50Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"1401fa1a-440e-490f-b9f0-8af2784cce74","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"not authenticated"}
{"level":"info","ts":"2026-07-12T20:02:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1401fa1a-440e-490f-b9f0-8af2784cce74","authorized":false,"response":"UNAUTHENTICATED","object":{"code":16,"status":401,"message":"Authentication required"}}
{"level":"debug","ts":"2026-07-12T20:02:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1401fa1a-440e-490f-b9f0-8af2784cce74","authorized":false,"response":"UNAUTHENTICATED","object":{"code":16,"status":401,"message":"Authentication required","headers":[{"WWW-Authenticate":"request.headers.authorization realm=\"api-keys\""},{"WWW-Authenticate":"Bearer **** realm=\"openshift-identities\""}]}}
{"level":"info","ts":"2026-07-12T20:02:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b92cb518-993a-4286-8b00-eb4fbd5c0764","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:49320","PortSpecifier":{"PortValue":49320}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.42:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b92cb518-993a-4286-8b00-eb4fbd5c0764","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T20:02:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b92cb518-993a-4286-8b00-eb4fbd5c0764","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:49320","PortSpecifier":{"PortValue":49320}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.42:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783886570,"nanos":582179477},"http":{"id":"b92cb518-993a-4286-8b00-eb4fbd5c0764","method":"POST","headers":{":authority":"maas.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer","content-length":"35","content-type":"application/json","forwarded":"for=52.71.36.72;host=maas.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com;proto=https","user-agent":"python-requests/2.32.5","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.12","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LTg4OHI3CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.42~maas-default-gateway-openshift-default-5896d4dd49-888r7.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"52.71.36.72,10.132.0.12","x-forwarded-host":"maas.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com","x-forwarded-port":"443","x-forwarded-proto":"https","x-request-id":"b92cb518-993a-4286-8b00-eb4fbd5c0764"},"path":"/maas-api/v1/api-keys","host":"maas.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com","scheme":"https","protocol":"HTTP/1.1"}},"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"metadata_context":{}}}
{"level":"debug","ts":"2026-07-12T20:02:50Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"b92cb518-993a-4286-8b00-eb4fbd5c0764","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"credential not found"}
{"level":"info","ts":"2026-07-12T20:02:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b92cb518-993a-4286-8b00-eb4fbd5c0764","authorized":false,"response":"UNAUTHENTICATED","object":{"code":16,"status":401,"message":"Authentication required"}}
{"level":"debug","ts":"2026-07-12T20:02:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b92cb518-993a-4286-8b00-eb4fbd5c0764","authorized":false,"response":"UNAUTHENTICATED","object":{"code":16,"status":401,"message":"Authentication required","headers":[{"WWW-Authenticate":"request.headers.authorization realm=\"api-keys\""},{"WWW-Authenticate":"Bearer **** realm=\"openshift-identities\""}]}}
{"level":"info","ts":"2026-07-12T20:02:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a467dc23-9b63-467f-86cb-eaaccd1b1d78","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:49336","PortSpecifier":{"PortValue":49336}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.42:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a467dc23-9b63-467f-86cb-eaaccd1b1d78","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T20:02:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a467dc23-9b63-467f-86cb-eaaccd1b1d78","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:49336","PortSpecifier":{"PortValue":49336}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.42:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783886570,"nanos":610782091},"http":{"id":"a467dc23-9b63-467f-86cb-eaaccd1b1d78","method":"POST","headers":{":authority":"maas.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","content-length":"36","content-type":"application/json","forwarded":"for=52.71.36.72;host=maas.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com;proto=https","user-agent":"python-requests/2.32.5","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.12","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LTg4OHI3CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.42~maas-default-gateway-openshift-default-5896d4dd49-888r7.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"52.71.36.72,10.132.0.12","x-forwarded-host":"maas.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com","x-forwarded-port":"443","x-forwarded-proto":"https","x-request-id":"a467dc23-9b63-467f-86cb-eaaccd1b1d78"},"path":"/maas-api/v1/api-keys","host":"maas.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com","scheme":"https","protocol":"HTTP/1.1"}},"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"metadata_context":{}}}
{"level":"info","ts":"2026-07-12T20:02:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a467dc23-9b63-467f-86cb-eaaccd1b1d78","authorized":false,"response":"UNAUTHENTICATED","object":{"code":16,"status":401,"message":"Authentication required"}}
{"level":"debug","ts":"2026-07-12T20:02:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a467dc23-9b63-467f-86cb-eaaccd1b1d78","authorized":false,"response":"UNAUTHENTICATED","object":{"code":16,"status":401,"message":"Authentication required","headers":[{"WWW-Authenticate":"request.headers.authorization realm=\"api-keys\""},{"WWW-Authenticate":"Bearer **** realm=\"openshift-identities\""}]}}
{"level":"info","ts":"2026-07-12T20:02:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"00118333-1d32-4daa-8fb2-e563867564d5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:49348","PortSpecifier":{"PortValue":49348}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.42:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"00118333-1d32-4daa-8fb2-e563867564d5","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T20:02:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"00118333-1d32-4daa-8fb2-e563867564d5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:49348","PortSpecifier":{"PortValue":49348}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.42:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783886570,"nanos":702375542},"http":{"id":"00118333-1d32-4daa-8fb2-e563867564d5","method":"POST","headers":{":authority":"maas.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T20:02:50Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"00118333-1d32-4daa-8fb2-e563867564d5","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"oidc: token is expired (Token Expiry: 2026-07-12 19:02:50 +0000 UTC)"}
{"level":"debug","ts":"2026-07-12T20:02:50Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"00118333-1d32-4daa-8fb2-e563867564d5","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-12T20:02:50Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"00118333-1d32-4daa-8fb2-e563867564d5","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"not authenticated"}
{"level":"info","ts":"2026-07-12T20:02:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"00118333-1d32-4daa-8fb2-e563867564d5","authorized":false,"response":"UNAUTHENTICATED","object":{"code":16,"status":401,"message":"Authentication required"}}
{"level":"debug","ts":"2026-07-12T20:02:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"00118333-1d32-4daa-8fb2-e563867564d5","authorized":false,"response":"UNAUTHENTICATED","object":{"code":16,"status":401,"message":"Authentication required","headers":[{"WWW-Authenticate":"request.headers.authorization realm=\"api-keys\""},{"WWW-Authenticate":"Bearer **** realm=\"openshift-identities\""}]}}
{"level":"info","ts":"2026-07-12T20:02:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2cd886926c990cc533fc61bcc58d2267e3283668d7b8a084238691cd7893c7be"}
{"level":"info","ts":"2026-07-12T20:02:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/bb35e0d4b17b4d5ca1ae4cb730c86731ab4c4e07e02af1c64671f9a8c4c16868"}
{"level":"info","ts":"2026-07-12T20:02:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/dfb3b6da41117eca2f16fc173ddbb334b86f2c8ec4d91585fe9473dc2dd3ed03"}
{"level":"info","ts":"2026-07-12T20:02:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/09006d98ceeca10d440996ffda0e81a64683d550ed1c3354b7ec9d72211222c0"}
{"level":"info","ts":"2026-07-12T20:02:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/096ebadafe5a6aea8d6dfb3a4dd7299f8068cb7f885de93472daca06ab52d6fc"}
{"level":"info","ts":"2026-07-12T20:02:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b2027e0b5bf7cc35ce10e8ab11c1540c7477a9a03bcf1dcbf76c77452fa6c2b6"}
{"level":"info","ts":"2026-07-12T20:02:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/55716d53519a2168a89de10a7c7208d702cd8957aa3c2802e28d04885fb83bdf"}
{"level":"info","ts":"2026-07-12T20:02:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/eef171055d3cc90c2e58999aae3c17bae93199ff1cf260d9df31e755cb9a3ff0"}
{"level":"info","ts":"2026-07-12T20:03:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/95014eebbc08a3a479e2bc1cff1a419e9d3051f2a828516f4eaa1e1abc819601"}
{"level":"info","ts":"2026-07-12T20:03:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d687df711b0f7d675202d76da80c71a5214ed84e3f20e330483d262ed723d0b5"}
{"level":"info","ts":"2026-07-12T20:03:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/83bbf45937cd34a3d178e1552910cb0fbf31a96829538aa03d276217b2860084"}
{"level":"info","ts":"2026-07-12T20:03:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1ddd3be45151f582df1977ffbea51082a326bd758190b88f970b092b80202f4e"}
{"level":"info","ts":"2026-07-12T20:03:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4afefd3ea4bcea72b642967721e8293dc2fb652f59e72794957c6b28b47587cc"}
{"level":"info","ts":"2026-07-12T20:03:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4ba261fd3c3c7a2a194bb9fae3ac72c27be7d1a7f9fb8cec904f57d17b69af09"}
{"level":"info","ts":"2026-07-12T20:03:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/99ae61318989c510af27c23d7349323de4f9b8fb3fb29de5345d7a0d76ae7d5f"}
{"level":"info","ts":"2026-07-12T20:03:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e995257ce44cf33976e6f2c9df520c993faae332f8c0db390d429bb6ab47e192"}
{"level":"info","ts":"2026-07-12T20:03:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2094bcfd-b855-4fd0-b480-c46dbbfeaa85","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:58102","PortSpecifier":{"PortValue":58102}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.42:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2094bcfd-b855-4fd0-b480-c46dbbfeaa85","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T20:03:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2094bcfd-b855-4fd0-b480-c46dbbfeaa85","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:58102","PortSpecifier":{"PortValue":58102}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.42:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783886635,"nanos":839902315},"http":{"id":"2094bcfd-b855-4fd0-b480-c46dbbfeaa85","method":"POST","headers":{":authority":"maas.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T20:03:55Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"2094bcfd-b855-4fd0-b480-c46dbbfeaa85","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"oidc: token is expired (Token Expiry: 2026-07-12 20:03:50 +0000 UTC)"}
{"level":"debug","ts":"2026-07-12T20:03:55Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"2094bcfd-b855-4fd0-b480-c46dbbfeaa85","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-12T20:03:55Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"2094bcfd-b855-4fd0-b480-c46dbbfeaa85","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"not authenticated"}
{"level":"info","ts":"2026-07-12T20:03:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2094bcfd-b855-4fd0-b480-c46dbbfeaa85","authorized":false,"response":"UNAUTHENTICATED","object":{"code":16,"status":401,"message":"Authentication required"}}
{"level":"debug","ts":"2026-07-12T20:03:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2094bcfd-b855-4fd0-b480-c46dbbfeaa85","authorized":false,"response":"UNAUTHENTICATED","object":{"code":16,"status":401,"message":"Authentication required","headers":[{"WWW-Authenticate":"request.headers.authorization realm=\"api-keys\""},{"WWW-Authenticate":"Bearer **** realm=\"openshift-identities\""}]}}
{"level":"info","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4450b15d-1e5b-41f7-afb2-0ee70d70dbd6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:58118","PortSpecifier":{"PortValue":58118}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.42:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"4450b15d-1e5b-41f7-afb2-0ee70d70dbd6","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4450b15d-1e5b-41f7-afb2-0ee70d70dbd6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:58118","PortSpecifier":{"PortValue":58118}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.42:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783886636,"nanos":220357270},"http":{"id":"4450b15d-1e5b-41f7-afb2-0ee70d70dbd6","method":"POST","headers":{":authority":"maas.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"4450b15d-1e5b-41f7-afb2-0ee70d70dbd6","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783886696,"groups":["Site-Reliability"],"iat":1783886636,"iss":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:4473ccf4-a590-6bf7-b507-15b524f28256","preferred_username":"bob_sre","scope":"profile email","sid":"N5BwJ2Egbn0T-8-i4-fJIoGy","sub":"9c1e163b-f675-4f98-b47b-c33d1a7aa92b","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"4450b15d-1e5b-41f7-afb2-0ee70d70dbd6","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783886696,"groups":["Site-Reliability"],"iat":1783886636,"iss":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:4473ccf4-a590-6bf7-b507-15b524f28256","preferred_username":"bob_sre","scope":"profile email","sid":"N5BwJ2Egbn0T-8-i4-fJIoGy","sub":"9c1e163b-f675-4f98-b47b-c33d1a7aa92b","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.42:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4450b15d-1e5b-41f7-afb2-0ee70d70dbd6","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4450b15d-1e5b-41f7-afb2-0ee70d70dbd6","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4450b15d-1e5b-41f7-afb2-0ee70d70dbd6","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4450b15d-1e5b-41f7-afb2-0ee70d70dbd6","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"4450b15d-1e5b-41f7-afb2-0ee70d70dbd6","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4450b15d-1e5b-41f7-afb2-0ee70d70dbd6","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"bob_sre"}
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4450b15d-1e5b-41f7-afb2-0ee70d70dbd6","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Site-Reliability\"]"}
{"level":"info","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4450b15d-1e5b-41f7-afb2-0ee70d70dbd6","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4450b15d-1e5b-41f7-afb2-0ee70d70dbd6","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b685a116-b2aa-407d-94ac-fd2d5ceac72c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:58122","PortSpecifier":{"PortValue":58122}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.42:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b685a116-b2aa-407d-94ac-fd2d5ceac72c","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b685a116-b2aa-407d-94ac-fd2d5ceac72c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:58122","PortSpecifier":{"PortValue":58122}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.42:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783886636,"nanos":444695107},"http":{"id":"b685a116-b2aa-407d-94ac-fd2d5ceac72c","method":"POST","headers":{":authority":"maas.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b685a116-b2aa-407d-94ac-fd2d5ceac72c","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783886696,"groups":["Engineering","Project-Alpha"],"iat":1783886636,"iss":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:2e6786b5-eb16-7f10-2528-425aa80e9fa8","preferred_username":"alice_lead","scope":"profile email","sid":"PB1bq59x42TOHeMY_odnytHR","sub":"b7cdd126-8752-41c3-add9-49abc1639715","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b685a116-b2aa-407d-94ac-fd2d5ceac72c","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783886696,"groups":["Engineering","Project-Alpha"],"iat":1783886636,"iss":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:2e6786b5-eb16-7f10-2528-425aa80e9fa8","preferred_username":"alice_lead","scope":"profile email","sid":"PB1bq59x42TOHeMY_odnytHR","sub":"b7cdd126-8752-41c3-add9-49abc1639715","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.42:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b685a116-b2aa-407d-94ac-fd2d5ceac72c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b685a116-b2aa-407d-94ac-fd2d5ceac72c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b685a116-b2aa-407d-94ac-fd2d5ceac72c","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b685a116-b2aa-407d-94ac-fd2d5ceac72c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"b685a116-b2aa-407d-94ac-fd2d5ceac72c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b685a116-b2aa-407d-94ac-fd2d5ceac72c","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b685a116-b2aa-407d-94ac-fd2d5ceac72c","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"alice_lead"}
{"level":"info","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b685a116-b2aa-407d-94ac-fd2d5ceac72c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b685a116-b2aa-407d-94ac-fd2d5ceac72c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"90c63346-049d-4073-9042-98de6071458a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:58132","PortSpecifier":{"PortValue":58132}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.42:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"90c63346-049d-4073-9042-98de6071458a","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"90c63346-049d-4073-9042-98de6071458a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:58132","PortSpecifier":{"PortValue":58132}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.42:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783886636,"nanos":478184520},"http":{"id":"90c63346-049d-4073-9042-98de6071458a","method":"GET","headers":{":authority":"maas.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"90c63346-049d-4073-9042-98de6071458a","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-jHJBt6UEKDb2NKX0_Q7vMFBJAASsyz2NyQRSteUMapaZjM7UHCS0Ux58A7cm"}
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"90c63346-049d-4073-9042-98de6071458a","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-jHJBt6UEKDb2NKX0_Q7vMFBJAASsyz2NyQRSteUMapaZjM7UHCS0Ux58A7cm\"}"}
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"90c63346-049d-4073-9042-98de6071458a","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"keyId":"4c791907-ee2f-4885-9787-eef0d861db63","keyName":"e2e-oidc-e85e68bc","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"4c791907-ee2f-4885-9787-eef0d861db63","username":"alice_lead","valid":true}}
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"90c63346-049d-4073-9042-98de6071458a","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"90c63346-049d-4073-9042-98de6071458a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"90c63346-049d-4073-9042-98de6071458a","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"90c63346-049d-4073-9042-98de6071458a","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"90c63346-049d-4073-9042-98de6071458a","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"90c63346-049d-4073-9042-98de6071458a","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"90c63346-049d-4073-9042-98de6071458a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"90c63346-049d-4073-9042-98de6071458a","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"90c63346-049d-4073-9042-98de6071458a","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"90c63346-049d-4073-9042-98de6071458a","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"118fa1d3-b28a-4197-806e-b0a084fb714e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:60556","PortSpecifier":{"PortValue":60556}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.42:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"118fa1d3-b28a-4197-806e-b0a084fb714e","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"118fa1d3-b28a-4197-806e-b0a084fb714e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:60556","PortSpecifier":{"PortValue":60556}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.42:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783886636,"nanos":506004147},"http":{"id":"118fa1d3-b28a-4197-806e-b0a084fb714e","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"118fa1d3-b28a-4197-806e-b0a084fb714e","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-jHJBt6UEKDb2NKX0_Q7vMFBJAASsyz2NyQRSteUMapaZjM7UHCS0Ux58A7cm"}
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"118fa1d3-b28a-4197-806e-b0a084fb714e","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-jHJBt6UEKDb2NKX0_Q7vMFBJAASsyz2NyQRSteUMapaZjM7UHCS0Ux58A7cm\"}"}
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"118fa1d3-b28a-4197-806e-b0a084fb714e","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"keyId":"4c791907-ee2f-4885-9787-eef0d861db63","keyName":"e2e-oidc-e85e68bc","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"4c791907-ee2f-4885-9787-eef0d861db63","username":"alice_lead","valid":true}}
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"118fa1d3-b28a-4197-806e-b0a084fb714e","config":"subscription-info","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"simulator-subscription\",\"username\":\"alice_lead\"}"}
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"118fa1d3-b28a-4197-806e-b0a084fb714e","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"118fa1d3-b28a-4197-806e-b0a084fb714e","input":{"auth":{"identity":"Bearer **** subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.42:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-jHJBt6UEKDb2NKX0_Q7vMFBJAASsyz2NyQRSteUMapaZjM7UHCS0Ux58A7cm","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.132.0.34","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LTg4OHI3CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.42~maas-default-gateway-openshift-default-5896d4dd49-888r7.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.34","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"118fa1d3-b28a-4197-806e-b0a084fb714e"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"118fa1d3-b28a-4197-806e-b0a084fb714e","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":506004147,"seconds":1783886636},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.34:60556","port":60556}}}
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"118fa1d3-b28a-4197-806e-b0a084fb714e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"118fa1d3-b28a-4197-806e-b0a084fb714e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"118fa1d3-b28a-4197-806e-b0a084fb714e","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"118fa1d3-b28a-4197-806e-b0a084fb714e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"118fa1d3-b28a-4197-806e-b0a084fb714e","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"118fa1d3-b28a-4197-806e-b0a084fb714e","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"118fa1d3-b28a-4197-806e-b0a084fb714e","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"118fa1d3-b28a-4197-806e-b0a084fb714e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"groups_str":"system:authenticated,Engineering,Project-Alpha","keyId":"4c791907-ee2f-4885-9787-eef0d861db63","keyName":"e2e-oidc-e85e68bc","selected_subscription":"simulator-subscription","selected_subscription_key":"models-as-a-service/simulator-subscription@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true},"userid":"alice_lead"}}
{"level":"info","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"118fa1d3-b28a-4197-806e-b0a084fb714e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"118fa1d3-b28a-4197-806e-b0a084fb714e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6f8871ea-d034-4077-9f1c-693d49e740ae","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:58148","PortSpecifier":{"PortValue":58148}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.42:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6f8871ea-d034-4077-9f1c-693d49e740ae","method":"POST","path":"/llm/facebook-opt-125m-simulated/v1/chat/completions","host":"maas.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6f8871ea-d034-4077-9f1c-693d49e740ae","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:58148","PortSpecifier":{"PortValue":58148}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.42:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783886636,"nanos":543100600},"http":{"id":"6f8871ea-d034-4077-9f1c-693d49e740ae","method":"POST","headers":{":authority":"maas.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6f8871ea-d034-4077-9f1c-693d49e740ae","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-jHJBt6UEKDb2NKX0_Q7vMFBJAASsyz2NyQRSteUMapaZjM7UHCS0Ux58A7cm"}
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6f8871ea-d034-4077-9f1c-693d49e740ae","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-jHJBt6UEKDb2NKX0_Q7vMFBJAASsyz2NyQRSteUMapaZjM7UHCS0Ux58A7cm\"}"}
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6f8871ea-d034-4077-9f1c-693d49e740ae","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"keyId":"4c791907-ee2f-4885-9787-eef0d861db63","keyName":"e2e-oidc-e85e68bc","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"4c791907-ee2f-4885-9787-eef0d861db63","username":"alice_lead","valid":true}}
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6f8871ea-d034-4077-9f1c-693d49e740ae","config":"subscription-info","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"simulator-subscription\",\"username\":\"alice_lead\"}"}
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6f8871ea-d034-4077-9f1c-693d49e740ae","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6f8871ea-d034-4077-9f1c-693d49e740ae","input":{"auth":{"identity":"Bearer **** subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}},"context":{"context_extensions":{"host":"311b1be286674fd5684c9ac59b318287dade9769cfe4aeebd8c88e2dc6b72418"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.42:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6f8871ea-d034-4077-9f1c-693d49e740ae","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6f8871ea-d034-4077-9f1c-693d49e740ae","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6f8871ea-d034-4077-9f1c-693d49e740ae","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6f8871ea-d034-4077-9f1c-693d49e740ae","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6f8871ea-d034-4077-9f1c-693d49e740ae","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6f8871ea-d034-4077-9f1c-693d49e740ae","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6f8871ea-d034-4077-9f1c-693d49e740ae","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6f8871ea-d034-4077-9f1c-693d49e740ae","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"groups_str":"system:authenticated,Engineering,Project-Alpha","keyId":"4c791907-ee2f-4885-9787-eef0d861db63","keyName":"e2e-oidc-e85e68bc","selected_subscription":"simulator-subscription","selected_subscription_key":"models-as-a-service/simulator-subscription@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true},"userid":"alice_lead"}}
{"level":"info","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6f8871ea-d034-4077-9f1c-693d49e740ae","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6f8871ea-d034-4077-9f1c-693d49e740ae","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6fb5c3a1-196a-4292-a4a3-fccd7ac55315","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:58158","PortSpecifier":{"PortValue":58158}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.42:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6fb5c3a1-196a-4292-a4a3-fccd7ac55315","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6fb5c3a1-196a-4292-a4a3-fccd7ac55315","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:58158","PortSpecifier":{"PortValue":58158}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.42:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783886636,"nanos":670541067},"http":{"id":"6fb5c3a1-196a-4292-a4a3-fccd7ac55315","method":"POST","headers":{":authority":"maas.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6fb5c3a1-196a-4292-a4a3-fccd7ac55315","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783886696,"groups":["Engineering","Project-Alpha"],"iat":1783886636,"iss":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:17f3f0f8-cbe0-ad53-5616-b03976895f10","preferred_username":"alice_lead","scope":"profile email","sid":"iR2yVFLh2Qk2frZxENHag56w","sub":"b7cdd126-8752-41c3-add9-49abc1639715","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6fb5c3a1-196a-4292-a4a3-fccd7ac55315","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783886696,"groups":["Engineering","Project-Alpha"],"iat":1783886636,"iss":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:17f3f0f8-cbe0-ad53-5616-b03976895f10","preferred_username":"alice_lead","scope":"profile email","sid":"iR2yVFLh2Qk2frZxENHag56w","sub":"b7cdd126-8752-41c3-add9-49abc1639715","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.42:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6fb5c3a1-196a-4292-a4a3-fccd7ac55315","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6fb5c3a1-196a-4292-a4a3-fccd7ac55315","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6fb5c3a1-196a-4292-a4a3-fccd7ac55315","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6fb5c3a1-196a-4292-a4a3-fccd7ac55315","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"6fb5c3a1-196a-4292-a4a3-fccd7ac55315","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6fb5c3a1-196a-4292-a4a3-fccd7ac55315","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6fb5c3a1-196a-4292-a4a3-fccd7ac55315","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"alice_lead"}
{"level":"info","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6fb5c3a1-196a-4292-a4a3-fccd7ac55315","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6fb5c3a1-196a-4292-a4a3-fccd7ac55315","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5d3afab6-4534-4b6a-8dfd-f23b7eba4f93","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:58160","PortSpecifier":{"PortValue":58160}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.42:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5d3afab6-4534-4b6a-8dfd-f23b7eba4f93","method":"DELETE","path":"/maas-api/v1/api-keys/9a569e23-2ae2-4d47-adf2-0781c5f69115","host":"maas.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5d3afab6-4534-4b6a-8dfd-f23b7eba4f93","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:58160","PortSpecifier":{"PortValue":58160}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.42:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783886636,"nanos":704623089},"http":{"id":"5d3afab6-4534-4b6a-8dfd-f23b7eba4f93","method":"DELETE","headers":{":authority":"maas.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/9a569e23-2ae2-4d47-adf2-0781c5f69115",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5d3afab6-4534-4b6a-8dfd-f23b7eba4f93","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783886696,"groups":["Engineering","Project-Alpha"],"iat":1783886636,"iss":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:17f3f0f8-cbe0-ad53-5616-b03976895f10","preferred_username":"alice_lead","scope":"profile email","sid":"iR2yVFLh2Qk2frZxENHag56w","sub":"b7cdd126-8752-41c3-add9-49abc1639715","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5d3afab6-4534-4b6a-8dfd-f23b7eba4f93","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783886696,"groups":["Engineering","Project-Alpha"],"iat":1783886636,"iss":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:17f3f0f8-cbe0-ad53-5616-b03976895f10","preferred_username":"alice_lead","scope":"profile email","sid":"iR2yVFLh2Qk2frZxENHag56w","sub":"b7cdd126-8752-41c3-add9-49abc1639715","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.42:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/9a569e23-2ae2-4d47-adf2-0781c5f69115",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5d3afab6-4534-4b6a-8dfd-f23b7eba4f93","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5d3afab6-4534-4b6a-8dfd-f23b7eba4f93","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5d3afab6-4534-4b6a-8dfd-f23b7eba4f93","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5d3afab6-4534-4b6a-8dfd-f23b7eba4f93","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"5d3afab6-4534-4b6a-8dfd-f23b7eba4f93","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5d3afab6-4534-4b6a-8dfd-f23b7eba4f93","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5d3afab6-4534-4b6a-8dfd-f23b7eba4f93","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5d3afab6-4534-4b6a-8dfd-f23b7eba4f93","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5d3afab6-4534-4b6a-8dfd-f23b7eba4f93","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4fbdc99f-4b76-4472-b02e-de30694c2f4f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:58172","PortSpecifier":{"PortValue":58172}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.42:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"4fbdc99f-4b76-4472-b02e-de30694c2f4f","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4fbdc99f-4b76-4472-b02e-de30694c2f4f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:58172","PortSpecifier":{"PortValue":58172}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.42:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783886636,"nanos":739881454},"http":{"id":"4fbdc99f-4b76-4472-b02e-de30694c2f4f","method":"GET","headers":{":authority":"maas.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"4fbdc99f-4b76-4472-b02e-de30694c2f4f","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-C34UnsXIQxnDmfRS_bqi1Q9cKZTcD7OU6IONrWh2rTlWzJ75jVQwT3JeLlnD"}
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"4fbdc99f-4b76-4472-b02e-de30694c2f4f","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-C34UnsXIQxnDmfRS_bqi1Q9cKZTcD7OU6IONrWh2rTlWzJ75jVQwT3JeLlnD\"}"}
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"4fbdc99f-4b76-4472-b02e-de30694c2f4f","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"reason":"key revoked or expired","tenant":"","valid":false}}
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"4fbdc99f-4b76-4472-b02e-de30694c2f4f","input":{"auth":{"identity":"Bearer **** revoked or expired","tenant":"","valid":false}}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.42:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4fbdc99f-4b76-4472-b02e-de30694c2f4f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access denied","request id":"4fbdc99f-4b76-4472-b02e-de30694c2f4f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"reason":"Unauthorized"}
{"level":"info","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4fbdc99f-4b76-4472-b02e-de30694c2f4f","authorized":false,"response":"PERMISSION_DENIED","object":{"code":7,"status":403,"message":"Unauthorized"}}
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4fbdc99f-4b76-4472-b02e-de30694c2f4f","authorized":false,"response":"PERMISSION_DENIED","object":{"code":7,"status":403,"message":"Unauthorized","headers":[{"content-type":"text/plain"},{"x-ext-auth-reason":""}]}}
{"level":"info","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"12457044-7d53-4e1d-9bf9-08ad360468cb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:58188","PortSpecifier":{"PortValue":58188}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.42:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"12457044-7d53-4e1d-9bf9-08ad360468cb","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"12457044-7d53-4e1d-9bf9-08ad360468cb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:58188","PortSpecifier":{"PortValue":58188}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.42:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783886636,"nanos":765132014},"http":{"id":"12457044-7d53-4e1d-9bf9-08ad360468cb","method":"GET","headers":{":authority":"maas.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"12457044-7d53-4e1d-9bf9-08ad360468cb","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-C34UnsXIQxnDmfRS_bqi1Q9cKZTcD7OU6IONrWh2rTlWzJ75jVQwT3JeLlnD"}
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"12457044-7d53-4e1d-9bf9-08ad360468cb","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-C34UnsXIQxnDmfRS_bqi1Q9cKZTcD7OU6IONrWh2rTlWzJ75jVQwT3JeLlnD\"}"}
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"12457044-7d53-4e1d-9bf9-08ad360468cb","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"reason":"key revoked or expired","tenant":"","valid":false}}
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"12457044-7d53-4e1d-9bf9-08ad360468cb","input":{"auth":{"identity":"Bearer **** revoked or expired","tenant":"","valid":false}}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.42:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"12457044-7d53-4e1d-9bf9-08ad360468cb","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access denied","request id":"12457044-7d53-4e1d-9bf9-08ad360468cb","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"reason":"Unauthorized"}
{"level":"info","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"12457044-7d53-4e1d-9bf9-08ad360468cb","authorized":false,"response":"PERMISSION_DENIED","object":{"code":7,"status":403,"message":"Unauthorized"}}
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"12457044-7d53-4e1d-9bf9-08ad360468cb","authorized":false,"response":"PERMISSION_DENIED","object":{"code":7,"status":403,"message":"Unauthorized","headers":[{"content-type":"text/plain"},{"x-ext-auth-reason":""}]}}
{"level":"info","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9b4e11c3-b619-4de6-be01-5946ee8ac33c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:58198","PortSpecifier":{"PortValue":58198}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.42:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9b4e11c3-b619-4de6-be01-5946ee8ac33c","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9b4e11c3-b619-4de6-be01-5946ee8ac33c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:58198","PortSpecifier":{"PortValue":58198}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.42:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783886636,"nanos":902090764},"http":{"id":"9b4e11c3-b619-4de6-be01-5946ee8ac33c","method":"POST","headers":{":authority":"maas.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"9b4e11c3-b619-4de6-be01-5946ee8ac33c","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"9b4e11c3-b619-4de6-be01-5946ee8ac33c","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"9b4e11c3-b619-4de6-be01-5946ee8ac33c","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"not authenticated"}
{"level":"info","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9b4e11c3-b619-4de6-be01-5946ee8ac33c","authorized":false,"response":"UNAUTHENTICATED","object":{"code":16,"status":401,"message":"Authentication required"}}
{"level":"debug","ts":"2026-07-12T20:03:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9b4e11c3-b619-4de6-be01-5946ee8ac33c","authorized":false,"response":"UNAUTHENTICATED","object":{"code":16,"status":401,"message":"Authentication required","headers":[{"WWW-Authenticate":"request.headers.authorization realm=\"api-keys\""},{"WWW-Authenticate":"Bearer **** realm=\"openshift-identities\""}]}}
{"level":"info","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6f53540b-9e30-4092-8751-4cda67e614c8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:58200","PortSpecifier":{"PortValue":58200}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.42:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6f53540b-9e30-4092-8751-4cda67e614c8","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6f53540b-9e30-4092-8751-4cda67e614c8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:58200","PortSpecifier":{"PortValue":58200}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.42:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783886637,"nanos":63047413},"http":{"id":"6f53540b-9e30-4092-8751-4cda67e614c8","method":"POST","headers":{":authority":"maas.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6f53540b-9e30-4092-8751-4cda67e614c8","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783886696,"groups":["Engineering","Project-Alpha"],"iat":1783886636,"iss":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:1f9c7242-abe8-589c-f904-e5f0e2650f17","preferred_username":"alice_lead","scope":"profile email","sid":"zqJ6uOGvw5PluBtmmiR8nrVf","sub":"b7cdd126-8752-41c3-add9-49abc1639715","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6f53540b-9e30-4092-8751-4cda67e614c8","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783886696,"groups":["Engineering","Project-Alpha"],"iat":1783886636,"iss":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:1f9c7242-abe8-589c-f904-e5f0e2650f17","preferred_username":"alice_lead","scope":"profile email","sid":"zqJ6uOGvw5PluBtmmiR8nrVf","sub":"b7cdd126-8752-41c3-add9-49abc1639715","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.42:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6f53540b-9e30-4092-8751-4cda67e614c8","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6f53540b-9e30-4092-8751-4cda67e614c8","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6f53540b-9e30-4092-8751-4cda67e614c8","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6f53540b-9e30-4092-8751-4cda67e614c8","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"6f53540b-9e30-4092-8751-4cda67e614c8","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6f53540b-9e30-4092-8751-4cda67e614c8","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6f53540b-9e30-4092-8751-4cda67e614c8","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6f53540b-9e30-4092-8751-4cda67e614c8","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6f53540b-9e30-4092-8751-4cda67e614c8","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7525ec01-8c30-401a-a09a-5fbfc4cbc51b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:58216","PortSpecifier":{"PortValue":58216}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.42:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"7525ec01-8c30-401a-a09a-5fbfc4cbc51b","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7525ec01-8c30-401a-a09a-5fbfc4cbc51b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:58216","PortSpecifier":{"PortValue":58216}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.42:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783886637,"nanos":91082623},"http":{"id":"7525ec01-8c30-401a-a09a-5fbfc4cbc51b","method":"POST","headers":{":authority":"maas.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"7525ec01-8c30-401a-a09a-5fbfc4cbc51b","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783886697,"groups":["Site-Reliability"],"iat":1783886637,"iss":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:0e2c2a40-ae36-ba61-8b69-093e1e2ae713","preferred_username":"bob_sre","scope":"profile email","sid":"wMC9E44HBGOzgnDqaG1y-aCA","sub":"9c1e163b-f675-4f98-b47b-c33d1a7aa92b","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"7525ec01-8c30-401a-a09a-5fbfc4cbc51b","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783886697,"groups":["Site-Reliability"],"iat":1783886637,"iss":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:0e2c2a40-ae36-ba61-8b69-093e1e2ae713","preferred_username":"bob_sre","scope":"profile email","sid":"wMC9E44HBGOzgnDqaG1y-aCA","sub":"9c1e163b-f675-4f98-b47b-c33d1a7aa92b","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.42:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7525ec01-8c30-401a-a09a-5fbfc4cbc51b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7525ec01-8c30-401a-a09a-5fbfc4cbc51b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7525ec01-8c30-401a-a09a-5fbfc4cbc51b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7525ec01-8c30-401a-a09a-5fbfc4cbc51b","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"7525ec01-8c30-401a-a09a-5fbfc4cbc51b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7525ec01-8c30-401a-a09a-5fbfc4cbc51b","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Site-Reliability\"]"}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7525ec01-8c30-401a-a09a-5fbfc4cbc51b","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"bob_sre"}
{"level":"info","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7525ec01-8c30-401a-a09a-5fbfc4cbc51b","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7525ec01-8c30-401a-a09a-5fbfc4cbc51b","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d50d2fe8-72d5-4285-8c4d-087ad8f76462","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:58222","PortSpecifier":{"PortValue":58222}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.42:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d50d2fe8-72d5-4285-8c4d-087ad8f76462","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d50d2fe8-72d5-4285-8c4d-087ad8f76462","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:58222","PortSpecifier":{"PortValue":58222}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.42:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783886637,"nanos":182721629},"http":{"id":"d50d2fe8-72d5-4285-8c4d-087ad8f76462","method":"POST","headers":{":authority":"maas.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d50d2fe8-72d5-4285-8c4d-087ad8f76462","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783886697,"groups":["Engineering","Project-Alpha"],"iat":1783886637,"iss":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:cfcbda75-b0bf-593d-6814-817dca7fe1bc","preferred_username":"alice_lead","scope":"profile email","sid":"18E3Cmdwuv5RNWa0tE1IUdRV","sub":"b7cdd126-8752-41c3-add9-49abc1639715","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d50d2fe8-72d5-4285-8c4d-087ad8f76462","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783886697,"groups":["Engineering","Project-Alpha"],"iat":1783886637,"iss":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:cfcbda75-b0bf-593d-6814-817dca7fe1bc","preferred_username":"alice_lead","scope":"profile email","sid":"18E3Cmdwuv5RNWa0tE1IUdRV","sub":"b7cdd126-8752-41c3-add9-49abc1639715","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.42:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d50d2fe8-72d5-4285-8c4d-087ad8f76462","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d50d2fe8-72d5-4285-8c4d-087ad8f76462","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d50d2fe8-72d5-4285-8c4d-087ad8f76462","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d50d2fe8-72d5-4285-8c4d-087ad8f76462","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"d50d2fe8-72d5-4285-8c4d-087ad8f76462","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d50d2fe8-72d5-4285-8c4d-087ad8f76462","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d50d2fe8-72d5-4285-8c4d-087ad8f76462","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"alice_lead"}
{"level":"info","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d50d2fe8-72d5-4285-8c4d-087ad8f76462","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d50d2fe8-72d5-4285-8c4d-087ad8f76462","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1ccf9195-08d3-4c1e-b8c1-7ac02152dba7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:58238","PortSpecifier":{"PortValue":58238}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.42:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1ccf9195-08d3-4c1e-b8c1-7ac02152dba7","method":"DELETE","path":"/maas-api/v1/api-keys/cc85626b-c5e8-4a28-be6f-bef209aff9d8","host":"maas.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1ccf9195-08d3-4c1e-b8c1-7ac02152dba7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:58238","PortSpecifier":{"PortValue":58238}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.42:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783886637,"nanos":210651081},"http":{"id":"1ccf9195-08d3-4c1e-b8c1-7ac02152dba7","method":"DELETE","headers":{":authority":"maas.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/cc85626b-c5e8-4a28-be6f-bef209aff9d8",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1ccf9195-08d3-4c1e-b8c1-7ac02152dba7","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783886697,"groups":["Engineering","Project-Alpha"],"iat":1783886637,"iss":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:cfcbda75-b0bf-593d-6814-817dca7fe1bc","preferred_username":"alice_lead","scope":"profile email","sid":"18E3Cmdwuv5RNWa0tE1IUdRV","sub":"b7cdd126-8752-41c3-add9-49abc1639715","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1ccf9195-08d3-4c1e-b8c1-7ac02152dba7","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783886697,"groups":["Engineering","Project-Alpha"],"iat":1783886637,"iss":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:cfcbda75-b0bf-593d-6814-817dca7fe1bc","preferred_username":"alice_lead","scope":"profile email","sid":"18E3Cmdwuv5RNWa0tE1IUdRV","sub":"b7cdd126-8752-41c3-add9-49abc1639715","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.42:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/cc85626b-c5e8-4a28-be6f-bef209aff9d8",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1ccf9195-08d3-4c1e-b8c1-7ac02152dba7","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1ccf9195-08d3-4c1e-b8c1-7ac02152dba7","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1ccf9195-08d3-4c1e-b8c1-7ac02152dba7","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1ccf9195-08d3-4c1e-b8c1-7ac02152dba7","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"1ccf9195-08d3-4c1e-b8c1-7ac02152dba7","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1ccf9195-08d3-4c1e-b8c1-7ac02152dba7","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1ccf9195-08d3-4c1e-b8c1-7ac02152dba7","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"alice_lead"}
{"level":"info","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1ccf9195-08d3-4c1e-b8c1-7ac02152dba7","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1ccf9195-08d3-4c1e-b8c1-7ac02152dba7","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"dec45bc5-9167-4c68-83d2-902d4f4e88fb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:58248","PortSpecifier":{"PortValue":58248}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.42:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"dec45bc5-9167-4c68-83d2-902d4f4e88fb","method":"DELETE","path":"/maas-api/v1/api-keys/cc85626b-c5e8-4a28-be6f-bef209aff9d8","host":"maas.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"dec45bc5-9167-4c68-83d2-902d4f4e88fb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:58248","PortSpecifier":{"PortValue":58248}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.42:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783886637,"nanos":247866205},"http":{"id":"dec45bc5-9167-4c68-83d2-902d4f4e88fb","method":"DELETE","headers":{":authority":"maas.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/cc85626b-c5e8-4a28-be6f-bef209aff9d8",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"dec45bc5-9167-4c68-83d2-902d4f4e88fb","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783886697,"groups":["Engineering","Project-Alpha"],"iat":1783886637,"iss":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:cfcbda75-b0bf-593d-6814-817dca7fe1bc","preferred_username":"alice_lead","scope":"profile email","sid":"18E3Cmdwuv5RNWa0tE1IUdRV","sub":"b7cdd126-8752-41c3-add9-49abc1639715","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"dec45bc5-9167-4c68-83d2-902d4f4e88fb","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783886697,"groups":["Engineering","Project-Alpha"],"iat":1783886637,"iss":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:cfcbda75-b0bf-593d-6814-817dca7fe1bc","preferred_username":"alice_lead","scope":"profile email","sid":"18E3Cmdwuv5RNWa0tE1IUdRV","sub":"b7cdd126-8752-41c3-add9-49abc1639715","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.42:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/cc85626b-c5e8-4a28-be6f-bef209aff9d8",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dec45bc5-9167-4c68-83d2-902d4f4e88fb","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dec45bc5-9167-4c68-83d2-902d4f4e88fb","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dec45bc5-9167-4c68-83d2-902d4f4e88fb","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dec45bc5-9167-4c68-83d2-902d4f4e88fb","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"dec45bc5-9167-4c68-83d2-902d4f4e88fb","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dec45bc5-9167-4c68-83d2-902d4f4e88fb","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dec45bc5-9167-4c68-83d2-902d4f4e88fb","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"dec45bc5-9167-4c68-83d2-902d4f4e88fb","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"dec45bc5-9167-4c68-83d2-902d4f4e88fb","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8d953a3c-c71c-4305-bbf1-07ed3b6a7eed","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:58262","PortSpecifier":{"PortValue":58262}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.42:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"8d953a3c-c71c-4305-bbf1-07ed3b6a7eed","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8d953a3c-c71c-4305-bbf1-07ed3b6a7eed","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:58262","PortSpecifier":{"PortValue":58262}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.42:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783886637,"nanos":345368898},"http":{"id":"8d953a3c-c71c-4305-bbf1-07ed3b6a7eed","method":"POST","headers":{":authority":"maas.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"8d953a3c-c71c-4305-bbf1-07ed3b6a7eed","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783886697,"groups":["Engineering","Project-Alpha"],"iat":1783886637,"iss":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:196e45cc-5757-81d5-1c0c-d4e7b220ad1a","preferred_username":"alice_lead","scope":"profile email","sid":"YIvsr2JorpE4lRGxYN04mDPZ","sub":"b7cdd126-8752-41c3-add9-49abc1639715","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"8d953a3c-c71c-4305-bbf1-07ed3b6a7eed","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783886697,"groups":["Engineering","Project-Alpha"],"iat":1783886637,"iss":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:196e45cc-5757-81d5-1c0c-d4e7b220ad1a","preferred_username":"alice_lead","scope":"profile email","sid":"YIvsr2JorpE4lRGxYN04mDPZ","sub":"b7cdd126-8752-41c3-add9-49abc1639715","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.42:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8d953a3c-c71c-4305-bbf1-07ed3b6a7eed","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8d953a3c-c71c-4305-bbf1-07ed3b6a7eed","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8d953a3c-c71c-4305-bbf1-07ed3b6a7eed","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8d953a3c-c71c-4305-bbf1-07ed3b6a7eed","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"8d953a3c-c71c-4305-bbf1-07ed3b6a7eed","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8d953a3c-c71c-4305-bbf1-07ed3b6a7eed","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8d953a3c-c71c-4305-bbf1-07ed3b6a7eed","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8d953a3c-c71c-4305-bbf1-07ed3b6a7eed","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8d953a3c-c71c-4305-bbf1-07ed3b6a7eed","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3523609f-4608-4bb3-99b9-56de488176e6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:58276","PortSpecifier":{"PortValue":58276}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.42:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3523609f-4608-4bb3-99b9-56de488176e6","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3523609f-4608-4bb3-99b9-56de488176e6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:58276","PortSpecifier":{"PortValue":58276}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.42:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783886637,"nanos":376954246},"http":{"id":"3523609f-4608-4bb3-99b9-56de488176e6","method":"GET","headers":{":authority":"maas.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3523609f-4608-4bb3-99b9-56de488176e6","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-4xsPzlhQCDOXvuEj_iMXuQWu9UZIrjvgIXTnfzTuLN5WPZKCPnDHJ5Onksby"}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3523609f-4608-4bb3-99b9-56de488176e6","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-4xsPzlhQCDOXvuEj_iMXuQWu9UZIrjvgIXTnfzTuLN5WPZKCPnDHJ5Onksby\"}"}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3523609f-4608-4bb3-99b9-56de488176e6","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"keyId":"caa3dceb-dbfd-4dcb-88dc-b16bc0435478","keyName":"e2e-oidc-1945552f","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"caa3dceb-dbfd-4dcb-88dc-b16bc0435478","username":"alice_lead","valid":true}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3523609f-4608-4bb3-99b9-56de488176e6","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3523609f-4608-4bb3-99b9-56de488176e6","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3523609f-4608-4bb3-99b9-56de488176e6","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3523609f-4608-4bb3-99b9-56de488176e6","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"3523609f-4608-4bb3-99b9-56de488176e6","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3523609f-4608-4bb3-99b9-56de488176e6","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3523609f-4608-4bb3-99b9-56de488176e6","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3523609f-4608-4bb3-99b9-56de488176e6","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3523609f-4608-4bb3-99b9-56de488176e6","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3523609f-4608-4bb3-99b9-56de488176e6","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f8d9871d-cd5f-43dc-be75-2b2a636640f5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:60556","PortSpecifier":{"PortValue":60556}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.42:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f8d9871d-cd5f-43dc-be75-2b2a636640f5","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f8d9871d-cd5f-43dc-be75-2b2a636640f5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:60556","PortSpecifier":{"PortValue":60556}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.42:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783886637,"nanos":384319791},"http":{"id":"f8d9871d-cd5f-43dc-be75-2b2a636640f5","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f8d9871d-cd5f-43dc-be75-2b2a636640f5","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-4xsPzlhQCDOXvuEj_iMXuQWu9UZIrjvgIXTnfzTuLN5WPZKCPnDHJ5Onksby"}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f8d9871d-cd5f-43dc-be75-2b2a636640f5","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-4xsPzlhQCDOXvuEj_iMXuQWu9UZIrjvgIXTnfzTuLN5WPZKCPnDHJ5Onksby\"}"}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f8d9871d-cd5f-43dc-be75-2b2a636640f5","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"keyId":"caa3dceb-dbfd-4dcb-88dc-b16bc0435478","keyName":"e2e-oidc-1945552f","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"caa3dceb-dbfd-4dcb-88dc-b16bc0435478","username":"alice_lead","valid":true}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f8d9871d-cd5f-43dc-be75-2b2a636640f5","config":"subscription-info","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"simulator-subscription\",\"username\":\"alice_lead\"}"}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f8d9871d-cd5f-43dc-be75-2b2a636640f5","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f8d9871d-cd5f-43dc-be75-2b2a636640f5","input":{"auth":{"identity":"Bearer **** subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.42:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-4xsPzlhQCDOXvuEj_iMXuQWu9UZIrjvgIXTnfzTuLN5WPZKCPnDHJ5Onksby","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.132.0.34","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LTg4OHI3CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.42~maas-default-gateway-openshift-default-5896d4dd49-888r7.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.34","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"f8d9871d-cd5f-43dc-be75-2b2a636640f5"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"f8d9871d-cd5f-43dc-be75-2b2a636640f5","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":384319791,"seconds":1783886637},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.34:60556","port":60556}}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f8d9871d-cd5f-43dc-be75-2b2a636640f5","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f8d9871d-cd5f-43dc-be75-2b2a636640f5","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f8d9871d-cd5f-43dc-be75-2b2a636640f5","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f8d9871d-cd5f-43dc-be75-2b2a636640f5","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f8d9871d-cd5f-43dc-be75-2b2a636640f5","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f8d9871d-cd5f-43dc-be75-2b2a636640f5","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f8d9871d-cd5f-43dc-be75-2b2a636640f5","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f8d9871d-cd5f-43dc-be75-2b2a636640f5","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"groups_str":"system:authenticated,Engineering,Project-Alpha","keyId":"caa3dceb-dbfd-4dcb-88dc-b16bc0435478","keyName":"e2e-oidc-1945552f","selected_subscription":"simulator-subscription","selected_subscription_key":"models-as-a-service/simulator-subscription@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true},"userid":"alice_lead"}}
{"level":"info","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f8d9871d-cd5f-43dc-be75-2b2a636640f5","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f8d9871d-cd5f-43dc-be75-2b2a636640f5","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"36377219-25de-410d-9f88-ec5ab58650c7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:58284","PortSpecifier":{"PortValue":58284}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.42:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"36377219-25de-410d-9f88-ec5ab58650c7","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"36377219-25de-410d-9f88-ec5ab58650c7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:58284","PortSpecifier":{"PortValue":58284}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.42:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783886637,"nanos":478465445},"http":{"id":"36377219-25de-410d-9f88-ec5ab58650c7","method":"POST","headers":{":authority":"maas.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"36377219-25de-410d-9f88-ec5ab58650c7","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783886697,"groups":["Engineering","Project-Alpha"],"iat":1783886637,"iss":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:6b2e2c9d-ec56-a4d2-42e9-6de4c4b2f874","preferred_username":"alice_lead","scope":"profile email","sid":"y4hR_WsP8hZNzlumB-GzIX29","sub":"b7cdd126-8752-41c3-add9-49abc1639715","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"36377219-25de-410d-9f88-ec5ab58650c7","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783886697,"groups":["Engineering","Project-Alpha"],"iat":1783886637,"iss":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:6b2e2c9d-ec56-a4d2-42e9-6de4c4b2f874","preferred_username":"alice_lead","scope":"profile email","sid":"y4hR_WsP8hZNzlumB-GzIX29","sub":"b7cdd126-8752-41c3-add9-49abc1639715","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.42:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"36377219-25de-410d-9f88-ec5ab58650c7","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"36377219-25de-410d-9f88-ec5ab58650c7","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"36377219-25de-410d-9f88-ec5ab58650c7","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"36377219-25de-410d-9f88-ec5ab58650c7","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"36377219-25de-410d-9f88-ec5ab58650c7","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"36377219-25de-410d-9f88-ec5ab58650c7","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"36377219-25de-410d-9f88-ec5ab58650c7","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"alice_lead"}
{"level":"info","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"36377219-25de-410d-9f88-ec5ab58650c7","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"36377219-25de-410d-9f88-ec5ab58650c7","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"67fa88c4-c8fc-4a01-b578-283054ee4e06","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:58286","PortSpecifier":{"PortValue":58286}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.42:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"67fa88c4-c8fc-4a01-b578-283054ee4e06","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"67fa88c4-c8fc-4a01-b578-283054ee4e06","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:58286","PortSpecifier":{"PortValue":58286}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.42:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783886637,"nanos":506193818},"http":{"id":"67fa88c4-c8fc-4a01-b578-283054ee4e06","method":"GET","headers":{":authority":"maas.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"67fa88c4-c8fc-4a01-b578-283054ee4e06","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-a0vxboZzXllNUqLR_9DhjpfzJZ3Q1z8lJf59xVewhPX2IsncHK7FY7dYsXsv"}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"67fa88c4-c8fc-4a01-b578-283054ee4e06","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-a0vxboZzXllNUqLR_9DhjpfzJZ3Q1z8lJf59xVewhPX2IsncHK7FY7dYsXsv\"}"}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"67fa88c4-c8fc-4a01-b578-283054ee4e06","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"keyId":"2cd2c2b1-e67b-44ed-97b8-ba6120c8cf9d","keyName":"e2e-oidc-8e8164bb","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"2cd2c2b1-e67b-44ed-97b8-ba6120c8cf9d","username":"alice_lead","valid":true}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"67fa88c4-c8fc-4a01-b578-283054ee4e06","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"67fa88c4-c8fc-4a01-b578-283054ee4e06","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"67fa88c4-c8fc-4a01-b578-283054ee4e06","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"67fa88c4-c8fc-4a01-b578-283054ee4e06","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"67fa88c4-c8fc-4a01-b578-283054ee4e06","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"67fa88c4-c8fc-4a01-b578-283054ee4e06","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"67fa88c4-c8fc-4a01-b578-283054ee4e06","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"67fa88c4-c8fc-4a01-b578-283054ee4e06","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"67fa88c4-c8fc-4a01-b578-283054ee4e06","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"67fa88c4-c8fc-4a01-b578-283054ee4e06","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c593bcd8-468e-49e3-abd0-6f06b91768d3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:58302","PortSpecifier":{"PortValue":58302}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.42:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c593bcd8-468e-49e3-abd0-6f06b91768d3","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c593bcd8-468e-49e3-abd0-6f06b91768d3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:58302","PortSpecifier":{"PortValue":58302}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.42:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783886637,"nanos":533232235},"http":{"id":"c593bcd8-468e-49e3-abd0-6f06b91768d3","method":"GET","headers":{":authority":"maas.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"c593bcd8-468e-49e3-abd0-6f06b91768d3","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-a0vxboZzXllNUqLR_9DhjpfzJZ3Q1z8lJf59xVewhPX2IsncHK7FY7dYsXsv"}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c593bcd8-468e-49e3-abd0-6f06b91768d3","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-a0vxboZzXllNUqLR_9DhjpfzJZ3Q1z8lJf59xVewhPX2IsncHK7FY7dYsXsv\"}"}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c593bcd8-468e-49e3-abd0-6f06b91768d3","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"keyId":"2cd2c2b1-e67b-44ed-97b8-ba6120c8cf9d","keyName":"e2e-oidc-8e8164bb","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"2cd2c2b1-e67b-44ed-97b8-ba6120c8cf9d","username":"alice_lead","valid":true}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"c593bcd8-468e-49e3-abd0-6f06b91768d3","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c593bcd8-468e-49e3-abd0-6f06b91768d3","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c593bcd8-468e-49e3-abd0-6f06b91768d3","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c593bcd8-468e-49e3-abd0-6f06b91768d3","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c593bcd8-468e-49e3-abd0-6f06b91768d3","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"c593bcd8-468e-49e3-abd0-6f06b91768d3","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c593bcd8-468e-49e3-abd0-6f06b91768d3","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c593bcd8-468e-49e3-abd0-6f06b91768d3","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c593bcd8-468e-49e3-abd0-6f06b91768d3","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c593bcd8-468e-49e3-abd0-6f06b91768d3","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"94996c18-6c2d-407a-9238-0ead4e87eb61","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:60556","PortSpecifier":{"PortValue":60556}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.42:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"94996c18-6c2d-407a-9238-0ead4e87eb61","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"94996c18-6c2d-407a-9238-0ead4e87eb61","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:60556","PortSpecifier":{"PortValue":60556}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.42:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783886637,"nanos":539817983},"http":{"id":"94996c18-6c2d-407a-9238-0ead4e87eb61","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"94996c18-6c2d-407a-9238-0ead4e87eb61","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-a0vxboZzXllNUqLR_9DhjpfzJZ3Q1z8lJf59xVewhPX2IsncHK7FY7dYsXsv"}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"94996c18-6c2d-407a-9238-0ead4e87eb61","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-a0vxboZzXllNUqLR_9DhjpfzJZ3Q1z8lJf59xVewhPX2IsncHK7FY7dYsXsv\"}"}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"94996c18-6c2d-407a-9238-0ead4e87eb61","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"keyId":"2cd2c2b1-e67b-44ed-97b8-ba6120c8cf9d","keyName":"e2e-oidc-8e8164bb","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"2cd2c2b1-e67b-44ed-97b8-ba6120c8cf9d","username":"alice_lead","valid":true}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"94996c18-6c2d-407a-9238-0ead4e87eb61","config":"subscription-info","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"simulator-subscription\",\"username\":\"alice_lead\"}"}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"94996c18-6c2d-407a-9238-0ead4e87eb61","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"94996c18-6c2d-407a-9238-0ead4e87eb61","input":{"auth":{"identity":"Bearer **** subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.42:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-a0vxboZzXllNUqLR_9DhjpfzJZ3Q1z8lJf59xVewhPX2IsncHK7FY7dYsXsv","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.132.0.34","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LTg4OHI3CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.42~maas-default-gateway-openshift-default-5896d4dd49-888r7.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.34","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"94996c18-6c2d-407a-9238-0ead4e87eb61"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"94996c18-6c2d-407a-9238-0ead4e87eb61","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":539817983,"seconds":1783886637},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.34:60556","port":60556}}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"94996c18-6c2d-407a-9238-0ead4e87eb61","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"94996c18-6c2d-407a-9238-0ead4e87eb61","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"94996c18-6c2d-407a-9238-0ead4e87eb61","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"94996c18-6c2d-407a-9238-0ead4e87eb61","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"94996c18-6c2d-407a-9238-0ead4e87eb61","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"94996c18-6c2d-407a-9238-0ead4e87eb61","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"94996c18-6c2d-407a-9238-0ead4e87eb61","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"94996c18-6c2d-407a-9238-0ead4e87eb61","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"groups_str":"system:authenticated,Engineering,Project-Alpha","keyId":"2cd2c2b1-e67b-44ed-97b8-ba6120c8cf9d","keyName":"e2e-oidc-8e8164bb","selected_subscription":"simulator-subscription","selected_subscription_key":"models-as-a-service/simulator-subscription@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true},"userid":"alice_lead"}}
{"level":"info","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"94996c18-6c2d-407a-9238-0ead4e87eb61","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"94996c18-6c2d-407a-9238-0ead4e87eb61","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5794ff65-d568-48e0-8b42-2102b8b2055c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:58312","PortSpecifier":{"PortValue":58312}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.42:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5794ff65-d568-48e0-8b42-2102b8b2055c","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5794ff65-d568-48e0-8b42-2102b8b2055c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:58312","PortSpecifier":{"PortValue":58312}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.42:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783886637,"nanos":631620900},"http":{"id":"5794ff65-d568-48e0-8b42-2102b8b2055c","method":"POST","headers":{":authority":"maas.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5794ff65-d568-48e0-8b42-2102b8b2055c","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783886697,"groups":["Engineering","Project-Alpha"],"iat":1783886637,"iss":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:20efeecc-b5fe-feef-9726-135573f146b1","preferred_username":"alice_lead","scope":"profile email","sid":"ShVIYwumdEeV-z_Hka9870tN","sub":"b7cdd126-8752-41c3-add9-49abc1639715","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5794ff65-d568-48e0-8b42-2102b8b2055c","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783886697,"groups":["Engineering","Project-Alpha"],"iat":1783886637,"iss":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:20efeecc-b5fe-feef-9726-135573f146b1","preferred_username":"alice_lead","scope":"profile email","sid":"ShVIYwumdEeV-z_Hka9870tN","sub":"b7cdd126-8752-41c3-add9-49abc1639715","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.42:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5794ff65-d568-48e0-8b42-2102b8b2055c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5794ff65-d568-48e0-8b42-2102b8b2055c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5794ff65-d568-48e0-8b42-2102b8b2055c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5794ff65-d568-48e0-8b42-2102b8b2055c","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"5794ff65-d568-48e0-8b42-2102b8b2055c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5794ff65-d568-48e0-8b42-2102b8b2055c","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5794ff65-d568-48e0-8b42-2102b8b2055c","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"alice_lead"}
{"level":"info","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5794ff65-d568-48e0-8b42-2102b8b2055c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5794ff65-d568-48e0-8b42-2102b8b2055c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3d0c0325-f4d7-4519-bf6a-b17ae0b3db3f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:58320","PortSpecifier":{"PortValue":58320}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.42:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3d0c0325-f4d7-4519-bf6a-b17ae0b3db3f","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3d0c0325-f4d7-4519-bf6a-b17ae0b3db3f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:58320","PortSpecifier":{"PortValue":58320}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.42:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783886637,"nanos":660555090},"http":{"id":"3d0c0325-f4d7-4519-bf6a-b17ae0b3db3f","method":"GET","headers":{":authority":"maas.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3d0c0325-f4d7-4519-bf6a-b17ae0b3db3f","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-MdYGoTW3sh7BTiTB_N4rHJ0n4BcrDcDLiC4WnUDst93JThPa4qeAqWeOiMiR"}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3d0c0325-f4d7-4519-bf6a-b17ae0b3db3f","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-MdYGoTW3sh7BTiTB_N4rHJ0n4BcrDcDLiC4WnUDst93JThPa4qeAqWeOiMiR\"}"}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3d0c0325-f4d7-4519-bf6a-b17ae0b3db3f","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"keyId":"813d962b-7e64-461d-a5d8-0d0e2b5ad96b","keyName":"e2e-oidc-2ef2b36a","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"813d962b-7e64-461d-a5d8-0d0e2b5ad96b","username":"alice_lead","valid":true}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3d0c0325-f4d7-4519-bf6a-b17ae0b3db3f","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3d0c0325-f4d7-4519-bf6a-b17ae0b3db3f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3d0c0325-f4d7-4519-bf6a-b17ae0b3db3f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3d0c0325-f4d7-4519-bf6a-b17ae0b3db3f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3d0c0325-f4d7-4519-bf6a-b17ae0b3db3f","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3d0c0325-f4d7-4519-bf6a-b17ae0b3db3f","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"3d0c0325-f4d7-4519-bf6a-b17ae0b3db3f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3d0c0325-f4d7-4519-bf6a-b17ae0b3db3f","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3d0c0325-f4d7-4519-bf6a-b17ae0b3db3f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3d0c0325-f4d7-4519-bf6a-b17ae0b3db3f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b5e1e1a8-e452-41ad-a03d-e1c2acda5aa3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:60556","PortSpecifier":{"PortValue":60556}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.42:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b5e1e1a8-e452-41ad-a03d-e1c2acda5aa3","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b5e1e1a8-e452-41ad-a03d-e1c2acda5aa3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:60556","PortSpecifier":{"PortValue":60556}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.42:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783886637,"nanos":667237566},"http":{"id":"b5e1e1a8-e452-41ad-a03d-e1c2acda5aa3","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b5e1e1a8-e452-41ad-a03d-e1c2acda5aa3","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-MdYGoTW3sh7BTiTB_N4rHJ0n4BcrDcDLiC4WnUDst93JThPa4qeAqWeOiMiR"}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b5e1e1a8-e452-41ad-a03d-e1c2acda5aa3","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-MdYGoTW3sh7BTiTB_N4rHJ0n4BcrDcDLiC4WnUDst93JThPa4qeAqWeOiMiR\"}"}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b5e1e1a8-e452-41ad-a03d-e1c2acda5aa3","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"keyId":"813d962b-7e64-461d-a5d8-0d0e2b5ad96b","keyName":"e2e-oidc-2ef2b36a","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"813d962b-7e64-461d-a5d8-0d0e2b5ad96b","username":"alice_lead","valid":true}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b5e1e1a8-e452-41ad-a03d-e1c2acda5aa3","config":"subscription-info","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"simulator-subscription\",\"username\":\"alice_lead\"}"}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b5e1e1a8-e452-41ad-a03d-e1c2acda5aa3","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b5e1e1a8-e452-41ad-a03d-e1c2acda5aa3","input":{"auth":{"identity":"Bearer **** subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.42:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-MdYGoTW3sh7BTiTB_N4rHJ0n4BcrDcDLiC4WnUDst93JThPa4qeAqWeOiMiR","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.132.0.34","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LTg4OHI3CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.42~maas-default-gateway-openshift-default-5896d4dd49-888r7.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.34","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"b5e1e1a8-e452-41ad-a03d-e1c2acda5aa3"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"b5e1e1a8-e452-41ad-a03d-e1c2acda5aa3","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":667237566,"seconds":1783886637},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.34:60556","port":60556}}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b5e1e1a8-e452-41ad-a03d-e1c2acda5aa3","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b5e1e1a8-e452-41ad-a03d-e1c2acda5aa3","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b5e1e1a8-e452-41ad-a03d-e1c2acda5aa3","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b5e1e1a8-e452-41ad-a03d-e1c2acda5aa3","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b5e1e1a8-e452-41ad-a03d-e1c2acda5aa3","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b5e1e1a8-e452-41ad-a03d-e1c2acda5aa3","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b5e1e1a8-e452-41ad-a03d-e1c2acda5aa3","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b5e1e1a8-e452-41ad-a03d-e1c2acda5aa3","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"groups_str":"system:authenticated,Engineering,Project-Alpha","keyId":"813d962b-7e64-461d-a5d8-0d0e2b5ad96b","keyName":"e2e-oidc-2ef2b36a","selected_subscription":"simulator-subscription","selected_subscription_key":"models-as-a-service/simulator-subscription@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true},"userid":"alice_lead"}}
{"level":"info","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b5e1e1a8-e452-41ad-a03d-e1c2acda5aa3","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b5e1e1a8-e452-41ad-a03d-e1c2acda5aa3","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f586720a-95ba-46c4-a008-d42a8f84be28","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:58326","PortSpecifier":{"PortValue":58326}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.42:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f586720a-95ba-46c4-a008-d42a8f84be28","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f586720a-95ba-46c4-a008-d42a8f84be28","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:58326","PortSpecifier":{"PortValue":58326}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.42:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783886637,"nanos":696885024},"http":{"id":"f586720a-95ba-46c4-a008-d42a8f84be28","method":"GET","headers":{":authority":"maas.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f586720a-95ba-46c4-a008-d42a8f84be28","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-MdYGoTW3sh7BTiTB_N4rHJ0n4BcrDcDLiC4WnUDst93JThPa4qeAqWeOiMiR"}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f586720a-95ba-46c4-a008-d42a8f84be28","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-MdYGoTW3sh7BTiTB_N4rHJ0n4BcrDcDLiC4WnUDst93JThPa4qeAqWeOiMiR\"}"}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f586720a-95ba-46c4-a008-d42a8f84be28","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"keyId":"813d962b-7e64-461d-a5d8-0d0e2b5ad96b","keyName":"e2e-oidc-2ef2b36a","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"813d962b-7e64-461d-a5d8-0d0e2b5ad96b","username":"alice_lead","valid":true}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f586720a-95ba-46c4-a008-d42a8f84be28","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f586720a-95ba-46c4-a008-d42a8f84be28","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f586720a-95ba-46c4-a008-d42a8f84be28","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f586720a-95ba-46c4-a008-d42a8f84be28","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"f586720a-95ba-46c4-a008-d42a8f84be28","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f586720a-95ba-46c4-a008-d42a8f84be28","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f586720a-95ba-46c4-a008-d42a8f84be28","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f586720a-95ba-46c4-a008-d42a8f84be28","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f586720a-95ba-46c4-a008-d42a8f84be28","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f586720a-95ba-46c4-a008-d42a8f84be28","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d8dd52d6-dbae-4dfe-9553-7d127b0686f6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:60556","PortSpecifier":{"PortValue":60556}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.42:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d8dd52d6-dbae-4dfe-9553-7d127b0686f6","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d8dd52d6-dbae-4dfe-9553-7d127b0686f6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:60556","PortSpecifier":{"PortValue":60556}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.42:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783886637,"nanos":703771039},"http":{"id":"d8dd52d6-dbae-4dfe-9553-7d127b0686f6","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d8dd52d6-dbae-4dfe-9553-7d127b0686f6","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-MdYGoTW3sh7BTiTB_N4rHJ0n4BcrDcDLiC4WnUDst93JThPa4qeAqWeOiMiR"}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d8dd52d6-dbae-4dfe-9553-7d127b0686f6","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-MdYGoTW3sh7BTiTB_N4rHJ0n4BcrDcDLiC4WnUDst93JThPa4qeAqWeOiMiR\"}"}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d8dd52d6-dbae-4dfe-9553-7d127b0686f6","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"keyId":"813d962b-7e64-461d-a5d8-0d0e2b5ad96b","keyName":"e2e-oidc-2ef2b36a","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"813d962b-7e64-461d-a5d8-0d0e2b5ad96b","username":"alice_lead","valid":true}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d8dd52d6-dbae-4dfe-9553-7d127b0686f6","config":"subscription-info","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"simulator-subscription\",\"username\":\"alice_lead\"}"}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d8dd52d6-dbae-4dfe-9553-7d127b0686f6","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d8dd52d6-dbae-4dfe-9553-7d127b0686f6","input":{"auth":{"identity":"Bearer **** subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.42:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-MdYGoTW3sh7BTiTB_N4rHJ0n4BcrDcDLiC4WnUDst93JThPa4qeAqWeOiMiR","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.132.0.34","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LTg4OHI3CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.42~maas-default-gateway-openshift-default-5896d4dd49-888r7.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.34","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"d8dd52d6-dbae-4dfe-9553-7d127b0686f6"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"d8dd52d6-dbae-4dfe-9553-7d127b0686f6","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":703771039,"seconds":1783886637},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.34:60556","port":60556}}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d8dd52d6-dbae-4dfe-9553-7d127b0686f6","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d8dd52d6-dbae-4dfe-9553-7d127b0686f6","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d8dd52d6-dbae-4dfe-9553-7d127b0686f6","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d8dd52d6-dbae-4dfe-9553-7d127b0686f6","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d8dd52d6-dbae-4dfe-9553-7d127b0686f6","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d8dd52d6-dbae-4dfe-9553-7d127b0686f6","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d8dd52d6-dbae-4dfe-9553-7d127b0686f6","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d8dd52d6-dbae-4dfe-9553-7d127b0686f6","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"groups_str":"system:authenticated,Engineering,Project-Alpha","keyId":"813d962b-7e64-461d-a5d8-0d0e2b5ad96b","keyName":"e2e-oidc-2ef2b36a","selected_subscription":"simulator-subscription","selected_subscription_key":"models-as-a-service/simulator-subscription@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true},"userid":"alice_lead"}}
{"level":"info","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d8dd52d6-dbae-4dfe-9553-7d127b0686f6","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d8dd52d6-dbae-4dfe-9553-7d127b0686f6","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"83880854-7dd9-40a5-a538-95fe8b37de00","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:58336","PortSpecifier":{"PortValue":58336}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.42:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"83880854-7dd9-40a5-a538-95fe8b37de00","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"83880854-7dd9-40a5-a538-95fe8b37de00","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:58336","PortSpecifier":{"PortValue":58336}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.42:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783886637,"nanos":792950427},"http":{"id":"83880854-7dd9-40a5-a538-95fe8b37de00","method":"POST","headers":{":authority":"maas.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"83880854-7dd9-40a5-a538-95fe8b37de00","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783886697,"groups":["Engineering","Project-Alpha"],"iat":1783886637,"iss":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:3febbfae-35ef-1122-ab25-08997b265813","preferred_username":"alice_lead","scope":"profile email","sid":"kkmigwtKIsyminzPU-WL0USY","sub":"b7cdd126-8752-41c3-add9-49abc1639715","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"83880854-7dd9-40a5-a538-95fe8b37de00","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783886697,"groups":["Engineering","Project-Alpha"],"iat":1783886637,"iss":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:3febbfae-35ef-1122-ab25-08997b265813","preferred_username":"alice_lead","scope":"profile email","sid":"kkmigwtKIsyminzPU-WL0USY","sub":"b7cdd126-8752-41c3-add9-49abc1639715","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.42:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"83880854-7dd9-40a5-a538-95fe8b37de00","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"83880854-7dd9-40a5-a538-95fe8b37de00","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"83880854-7dd9-40a5-a538-95fe8b37de00","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"83880854-7dd9-40a5-a538-95fe8b37de00","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"83880854-7dd9-40a5-a538-95fe8b37de00","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"83880854-7dd9-40a5-a538-95fe8b37de00","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"83880854-7dd9-40a5-a538-95fe8b37de00","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"alice_lead"}
{"level":"info","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"83880854-7dd9-40a5-a538-95fe8b37de00","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T20:03:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"83880854-7dd9-40a5-a538-95fe8b37de00","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T20:04:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/cd452b3491b4064e772f38d1a288406bb3889f19efd54af26f6554f07046a8c0","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:04:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/1ef3f8313d73a7c14b76ea704cc3f23f015b2ab50034887cf570208a050e9863","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:04:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/707878bcd632125ecab845de29fc41570ff2eb882a04dea05a2e77c0ea6d31f9","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:04:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/a394737442ca47bfbcb906bcf34d05c5515587984942470db6d6858608ab543a","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:04:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/630f18b14e5ce0234d4da773011770ac52ec305a1af3397f72696bf5262056bb","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:04:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/86d7031d507d6d31ee8bd9bdcfe4da1ec7d3ef91ae9fcfea8ed412594eae9e2b"}
{"level":"debug","ts":"2026-07-12T20:04:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:04:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ee6fe41741d318ef9a23db979185da67e66f4ff7b4ced5159dd8a35df3c98c27"}
{"level":"debug","ts":"2026-07-12T20:04:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/b1f82c4ba6cc7617f9c0b90067f72f4a25fdc5de2564c14ccb90af534a2905f6","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:04:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/3dc75fc8307b952a3e873400cf417e90f2861e8a225abec4b22708deb7901db7","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:04:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/331dc257e65f55f80700a586f7807093eda7b3d8e7d91215dc3c47731508480c","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:04:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/80f10756c0e833d16937036ed66f1daf5bef95559ef05a5e852766b97b9bdaef","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:04:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/101d9a4d9b715268b3a3623fb114473501068b7352d534f324f4a3121b535746","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:04:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/305bde7d554d0d2810b101d2b8d4e0e15521c2afbf16166555b8e9aa4ed39a3d","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:04:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:04:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/cc09b530b46a73b0d4ddb40e465580cff15db19d77e93e4903c9737647deeb1a","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:04:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9903213c635804dd416e9f12956f0fa896195627091daaf593a30df64cf640c5","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:04:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/f9a2a1e13eaadb4f450e63a68a3d05ec02a537019380f832f5992d1c5cdee533","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:04:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/ba8750633b915855593e941d13c912f4f6c6d6c6a659c241b67d178bbe85f188","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:04:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/319a353672fc7601c875fa3f8b807adf60b64f093f022b2a1c3dfef3ac8cd4f4","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:04:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/edcceb5a2e0cf1edde0fc3ed43068ce5b123a6fdc41949959c2c3b7a5a48bf24","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:04:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:04:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/e50f5fdcb9fb7e124557afe69edae9a95d05da488eae1cc4b5c1c7c1220a826a","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:04:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/311b1be286674fd5684c9ac59b318287dade9769cfe4aeebd8c88e2dc6b72418","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:04:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/47d4519f979dd8b06fb3b12ecf63e079887e8b64c789a1ff79b4c429f3a6aa2a","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:04:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4dc577fd60594d78a4a8bebe396f4b5a928f41bdc3f95c06d717cf1ddc3158b2","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:04:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/df733b2c652bfe2458c9e19932b1091e939c1a62178d6879462b3b4f73fca4bb","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:04:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/e9607d3c9394ff787a7cb9306c470b1007979008e27c6d6c68281553a4653faa","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:04:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/30c4b39450ec876cfb2b0e66cbea2a74b7bcfafcf83d80a94c503487492e5a48","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:04:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/01918e70442d2cb18c94316131b0e0a241b4a5d12df5b1e1981a3bef420bbdb5","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:04:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/98dd9311f361e75de96f77b800598c9f5c79c7fa539cfd493b5f7631f8efab90","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:04:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/18e32965997cdd9967355c6fa5264ed12c0a215989d459ed88d7d6de02865f76","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:04:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:04:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/d66f5b12bbb76f83ef1cb89313ae7356d9a4c974f276c1405eefa0cb8d66ceda","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:04:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/3774b789b89cb794db9f2ae5a4e410c6a000c480af86f9e4466977b4dc7de25a","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:04:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/a124e7db3701742524b9534a4ba1eb68cc6d8f337ccc26c3f8f17b958cc795d0","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:04:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/e38d76c6f386f12bc12190c87b39e6e77e182be454f85659a9197c301f2cd9be","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:04:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/35d34d59676c333235d7c9f02273e0380bb39f27cfd30856fedc0f7c0e5f79aa","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:04:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/3d32277ea538e86091b57e14fc6f6582cbe1daa3e7e81223282a75b03a512083","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:04:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/5fea747cb803a5ee3aeb620187bd9ec74ccccd10a92474ef528215a7ff146c8f","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:04:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/888fdad5bc63ac36546012ce97b2af4b7b1a45ef243fd2eba72f12c306f06e3e","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:04:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:04:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9f3df6834dcf2df14d188decd66432f3940127e3a8261065cd3a44bd9ed1db6d","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:04:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9bbfc0b2e9e9acadd41342cd7c36a24afa8a5eef942d161782a6adae8411158a","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:04:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/bf72a6316f6ed79299511e58d068836cdc71dbca5e23944f783c9340ffa0aee1","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:04:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/7371c34ce8e4df2309ee8f952c87f921947b289427b6e9ea579dcb9970fc1b86","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:04:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/452d598a0ad1047944cd02d3654e6793847781ecc87763544a69e05020a86cf3","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:04:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/c098209e055107073c6ded1d63e221315c2239f3cf17a7d15056a7494c5714fb","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:04:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4325b2a5e55bf181d1f503f5c3cbce3259c00ca301216d4ea5bc6b962627f1bd","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:04:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/98b96558d098c10ea5cd4b877712861a71c554909b27785cf9b672cf28954a5a","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:04:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/3dd75e19cd66d310c30638e330078972afd6d2d96305f91055bc6a6f363fb8d3","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:04:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/d3b195a61a7f24c6bf1fba40f9f2e2565facb6af92e959c1546ac398a9172618","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-12T20:04:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/86cbb62fb4d82d4dc402b3281444539a5625c4bb4c86bbc4912c70e690a2e374","issuerUrl":"https://keycloak.apps.4242e614-1fce-419c-aead-b1708c845c3c.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-12T20:04:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b8efafc31b6416bc2a9bedf366ecde25c30fa30b41e33922bdcfb8f1a9e8be15"}
{"level":"info","ts":"2026-07-12T20:04:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4c00f298f9197cfe1b0ccafae219eae9ca99cf8a4838542b4a1620760b1bbea3"}