{"level":"info","ts":"2026-07-28T05:04:27Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7bc011a2-2e05-4225-9d9d-9e518f526f53","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:47364","PortSpecifier":{"PortValue":47364}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.82:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"7bc011a2-2e05-4225-9d9d-9e518f526f53","method":"POST","path":"/ai-tenant-e2e-shared-a-1badbb/rate-test-model-1badbb/v1/completions","host":"e2e-shared-a-1badbb.apps.4b968787-e1ff-4996-be24-1047ba8bf1d6.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-28T05:04:27Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7bc011a2-2e05-4225-9d9d-9e518f526f53","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:47364","PortSpecifier":{"PortValue":47364}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.82:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785215067,"nanos":533088803},"http":{"id":"7bc011a2-2e05-4225-9d9d-9e518f526f53","method":"POST","headers":{":authority":"e2e-shared-a-1badbb.apps.4b968787-e1ff-4996-be24-1047ba8bf1d6.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-1badbb/rate-test-model-1badbb/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T05:04:27Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"7bc011a2-2e05-4225-9d9d-9e518f526f53","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-8J873JYWWwOky25o_dTBLX0FgjLIvywc0BHQdVBV2MyUVAOrOJOCTo0LA4PD"}
{"level":"debug","ts":"2026-07-28T05:04:27Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"7bc011a2-2e05-4225-9d9d-9e518f526f53","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-1badbb.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-8J873JYWWwOky25o_dTBLX0FgjLIvywc0BHQdVBV2MyUVAOrOJOCTo0LA4PD\"}"}
{"level":"debug","ts":"2026-07-28T05:04:27Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"7bc011a2-2e05-4225-9d9d-9e518f526f53","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1badbb.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"955cc128-137b-452f-bcd5-9eee7a06302d","keyName":"e2e-rate-a-c82e35","subscription":"e2e-rate-iso-a-c82e35","tenant":"e2e-shared-a-1badbb","userId":"955cc128-137b-452f-bcd5-9eee7a06302d","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-28T05:04:27Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"7bc011a2-2e05-4225-9d9d-9e518f526f53","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-1badbb.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-1badbb/rate-test-model-1badbb\",\"requestedSubscription\":\"e2e-rate-iso-a-c82e35\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-28T05:04:27Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"7bc011a2-2e05-4225-9d9d-9e518f526f53","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1badbb.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-1badbb/models/facebook/opt-125m","name":"rate-test-model-1badbb","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-c82e35","namespace":"ai-tenant-e2e-shared-a-1badbb","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-1badbb/rate-test-model-1badbb"}}
{"level":"debug","ts":"2026-07-28T05:04:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"7bc011a2-2e05-4225-9d9d-9e518f526f53","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T05:04:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7bc011a2-2e05-4225-9d9d-9e518f526f53","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T05:04:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7bc011a2-2e05-4225-9d9d-9e518f526f53","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T05:04:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7bc011a2-2e05-4225-9d9d-9e518f526f53","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T05:04:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7bc011a2-2e05-4225-9d9d-9e518f526f53","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1badbb/rate-test-model-1badbb\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-1badbb/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T05:04:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7bc011a2-2e05-4225-9d9d-9e518f526f53","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-28T05:04:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7bc011a2-2e05-4225-9d9d-9e518f526f53","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-c82e35"}
{"level":"debug","ts":"2026-07-28T05:04:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7bc011a2-2e05-4225-9d9d-9e518f526f53","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-28T05:04:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7bc011a2-2e05-4225-9d9d-9e518f526f53","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"955cc128-137b-452f-bcd5-9eee7a06302d","keyName":"e2e-rate-a-c82e35","selected_subscription":"e2e-rate-iso-a-c82e35","selected_subscription_key":"ai-tenant-e2e-shared-a-1badbb/e2e-rate-iso-a-c82e35@ai-tenant-e2e-shared-a-1badbb/rate-test-model-1badbb","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-1badbb/models/facebook/opt-125m","name":"rate-test-model-1badbb","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-c82e35","namespace":"ai-tenant-e2e-shared-a-1badbb","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-1badbb/rate-test-model-1badbb"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-28T05:04:27Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7bc011a2-2e05-4225-9d9d-9e518f526f53","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-28T05:04:27Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7bc011a2-2e05-4225-9d9d-9e518f526f53","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-28T05:04:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7bbbc621-62f1-4e45-99cd-8a91cf37b6a4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:51410","PortSpecifier":{"PortValue":51410}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.82:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"7bbbc621-62f1-4e45-99cd-8a91cf37b6a4","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-1badbb.apps.4b968787-e1ff-4996-be24-1047ba8bf1d6.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-28T05:04:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7bbbc621-62f1-4e45-99cd-8a91cf37b6a4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:51410","PortSpecifier":{"PortValue":51410}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.82:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785215086,"nanos":866963088},"http":{"id":"7bbbc621-62f1-4e45-99cd-8a91cf37b6a4","method":"POST","headers":{":authority":"e2e-shared-a-1badbb.apps.4b968787-e1ff-4996-be24-1047ba8bf1d6.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T05:04:46Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"7bbbc621-62f1-4e45-99cd-8a91cf37b6a4","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-28T05:04:46Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"7bbbc621-62f1-4e45-99cd-8a91cf37b6a4","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"a6220b9a-f932-4104-9d94-f7ddcf1fc828","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=36cff924-3b00-4199-a9fb-56d9bf87c328"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1047ba8bf1d6"]}}
{"level":"debug","ts":"2026-07-28T05:04:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"7bbbc621-62f1-4e45-99cd-8a91cf37b6a4","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1047ba8bf1d6"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=36cff924-3b00-4199-a9fb-56d9bf87c328"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"a6220b9a-f932-4104-9d94-f7ddcf1fc828","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"3c1360578a45ae050457787afdfd3d4d40497dbb864a14b5b7a5ac889d500700"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.82:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-1badbb.apps.4b968787-e1ff-4996-be24-1047ba8bf1d6.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T05:04:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7bbbc621-62f1-4e45-99cd-8a91cf37b6a4","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T05:04:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7bbbc621-62f1-4e45-99cd-8a91cf37b6a4","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T05:04:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7bbbc621-62f1-4e45-99cd-8a91cf37b6a4","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1badbb/rate-test-model-1badbb\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-1badbb/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T05:04:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"7bbbc621-62f1-4e45-99cd-8a91cf37b6a4","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-28T05:04:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7bbbc621-62f1-4e45-99cd-8a91cf37b6a4","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-28T05:04:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7bbbc621-62f1-4e45-99cd-8a91cf37b6a4","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-28T05:04:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7bbbc621-62f1-4e45-99cd-8a91cf37b6a4","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-28T05:04:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7bbbc621-62f1-4e45-99cd-8a91cf37b6a4","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-28T05:04:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5c0ed2ee-69f2-4c06-bd38-3eb9b10ae28a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:46600","PortSpecifier":{"PortValue":46600}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5c0ed2ee-69f2-4c06-bd38-3eb9b10ae28a","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-92c557.apps.4b968787-e1ff-4996-be24-1047ba8bf1d6.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-28T05:04:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5c0ed2ee-69f2-4c06-bd38-3eb9b10ae28a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:46600","PortSpecifier":{"PortValue":46600}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785215086,"nanos":906711614},"http":{"id":"5c0ed2ee-69f2-4c06-bd38-3eb9b10ae28a","method":"POST","headers":{":authority":"e2e-shared-b-92c557.apps.4b968787-e1ff-4996-be24-1047ba8bf1d6.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T05:04:46Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"5c0ed2ee-69f2-4c06-bd38-3eb9b10ae28a","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-28T05:04:46Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5c0ed2ee-69f2-4c06-bd38-3eb9b10ae28a","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"a6220b9a-f932-4104-9d94-f7ddcf1fc828","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=36cff924-3b00-4199-a9fb-56d9bf87c328"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1047ba8bf1d6"]}}
{"level":"debug","ts":"2026-07-28T05:04:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5c0ed2ee-69f2-4c06-bd38-3eb9b10ae28a","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1047ba8bf1d6"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=36cff924-3b00-4199-a9fb-56d9bf87c328"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"a6220b9a-f932-4104-9d94-f7ddcf1fc828","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"cf14d932303793268f3c79ed08131d44ffad52d21b0243772bf6a90d5fbb3f5f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.57:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-92c557.apps.4b968787-e1ff-4996-be24-1047ba8bf1d6.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T05:04:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5c0ed2ee-69f2-4c06-bd38-3eb9b10ae28a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T05:04:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5c0ed2ee-69f2-4c06-bd38-3eb9b10ae28a","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T05:04:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5c0ed2ee-69f2-4c06-bd38-3eb9b10ae28a","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-92c557/rate-test-model-92c557\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-92c557/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T05:04:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"5c0ed2ee-69f2-4c06-bd38-3eb9b10ae28a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-28T05:04:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5c0ed2ee-69f2-4c06-bd38-3eb9b10ae28a","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-28T05:04:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5c0ed2ee-69f2-4c06-bd38-3eb9b10ae28a","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-28T05:04:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5c0ed2ee-69f2-4c06-bd38-3eb9b10ae28a","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-28T05:04:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5c0ed2ee-69f2-4c06-bd38-3eb9b10ae28a","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-28T05:04:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b7fb7077-668b-4995-8501-8c82a48c2973","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:51414","PortSpecifier":{"PortValue":51414}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.82:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b7fb7077-668b-4995-8501-8c82a48c2973","method":"POST","path":"/ai-tenant-e2e-shared-a-1badbb/rate-test-model-1badbb/v1/completions","host":"e2e-shared-a-1badbb.apps.4b968787-e1ff-4996-be24-1047ba8bf1d6.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-28T05:04:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b7fb7077-668b-4995-8501-8c82a48c2973","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:51414","PortSpecifier":{"PortValue":51414}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.82:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785215086,"nanos":940712093},"http":{"id":"b7fb7077-668b-4995-8501-8c82a48c2973","method":"POST","headers":{":authority":"e2e-shared-a-1badbb.apps.4b968787-e1ff-4996-be24-1047ba8bf1d6.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-1badbb/rate-test-model-1badbb/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T05:04:46Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b7fb7077-668b-4995-8501-8c82a48c2973","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1boP35Ei853FTE9s5_yT4Okhlc4VG1H5nldlGFwKKkNCXPHAa2i58tsdaX8Jy"}
{"level":"debug","ts":"2026-07-28T05:04:46Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b7fb7077-668b-4995-8501-8c82a48c2973","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-1badbb.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1boP35Ei853FTE9s5_yT4Okhlc4VG1H5nldlGFwKKkNCXPHAa2i58tsdaX8Jy\"}"}
{"level":"debug","ts":"2026-07-28T05:04:46Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b7fb7077-668b-4995-8501-8c82a48c2973","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1badbb.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"154866f0-304f-46e2-8747-5c8d261c9839","keyName":"e2e-rate-a-6deefc","subscription":"e2e-rate-iso-a-6deefc","tenant":"e2e-shared-a-1badbb","userId":"154866f0-304f-46e2-8747-5c8d261c9839","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-28T05:04:46Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b7fb7077-668b-4995-8501-8c82a48c2973","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-1badbb.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-1badbb/rate-test-model-1badbb\",\"requestedSubscription\":\"e2e-rate-iso-a-6deefc\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-28T05:04:46Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b7fb7077-668b-4995-8501-8c82a48c2973","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1badbb.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-1badbb/models/facebook/opt-125m","name":"rate-test-model-1badbb","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6deefc","namespace":"ai-tenant-e2e-shared-a-1badbb","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-1badbb/rate-test-model-1badbb"}}
{"level":"debug","ts":"2026-07-28T05:04:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b7fb7077-668b-4995-8501-8c82a48c2973","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T05:04:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b7fb7077-668b-4995-8501-8c82a48c2973","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T05:04:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b7fb7077-668b-4995-8501-8c82a48c2973","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T05:04:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b7fb7077-668b-4995-8501-8c82a48c2973","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1badbb/rate-test-model-1badbb\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-1badbb/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T05:04:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b7fb7077-668b-4995-8501-8c82a48c2973","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T05:04:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b7fb7077-668b-4995-8501-8c82a48c2973","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-28T05:04:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b7fb7077-668b-4995-8501-8c82a48c2973","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-6deefc"}
{"level":"debug","ts":"2026-07-28T05:04:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b7fb7077-668b-4995-8501-8c82a48c2973","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-28T05:04:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b7fb7077-668b-4995-8501-8c82a48c2973","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"154866f0-304f-46e2-8747-5c8d261c9839","keyName":"e2e-rate-a-6deefc","selected_subscription":"e2e-rate-iso-a-6deefc","selected_subscription_key":"ai-tenant-e2e-shared-a-1badbb/e2e-rate-iso-a-6deefc@ai-tenant-e2e-shared-a-1badbb/rate-test-model-1badbb","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-1badbb/models/facebook/opt-125m","name":"rate-test-model-1badbb","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6deefc","namespace":"ai-tenant-e2e-shared-a-1badbb","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-1badbb/rate-test-model-1badbb"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-28T05:04:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b7fb7077-668b-4995-8501-8c82a48c2973","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-28T05:04:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b7fb7077-668b-4995-8501-8c82a48c2973","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-28T05:04:47Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"97de8bd9-4f11-450c-bf52-4ba85a3f29c7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:51420","PortSpecifier":{"PortValue":51420}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.82:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"97de8bd9-4f11-450c-bf52-4ba85a3f29c7","method":"POST","path":"/ai-tenant-e2e-shared-a-1badbb/rate-test-model-1badbb/v1/completions","host":"e2e-shared-a-1badbb.apps.4b968787-e1ff-4996-be24-1047ba8bf1d6.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-28T05:04:47Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"97de8bd9-4f11-450c-bf52-4ba85a3f29c7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:51420","PortSpecifier":{"PortValue":51420}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.82:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785215087,"nanos":984959884},"http":{"id":"97de8bd9-4f11-450c-bf52-4ba85a3f29c7","method":"POST","headers":{":authority":"e2e-shared-a-1badbb.apps.4b968787-e1ff-4996-be24-1047ba8bf1d6.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-1badbb/rate-test-model-1badbb/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T05:04:47Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"97de8bd9-4f11-450c-bf52-4ba85a3f29c7","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1boP35Ei853FTE9s5_yT4Okhlc4VG1H5nldlGFwKKkNCXPHAa2i58tsdaX8Jy"}
{"level":"debug","ts":"2026-07-28T05:04:47Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"97de8bd9-4f11-450c-bf52-4ba85a3f29c7","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-1badbb.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1boP35Ei853FTE9s5_yT4Okhlc4VG1H5nldlGFwKKkNCXPHAa2i58tsdaX8Jy\"}"}
{"level":"debug","ts":"2026-07-28T05:04:47Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"97de8bd9-4f11-450c-bf52-4ba85a3f29c7","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1badbb.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"154866f0-304f-46e2-8747-5c8d261c9839","keyName":"e2e-rate-a-6deefc","subscription":"e2e-rate-iso-a-6deefc","tenant":"e2e-shared-a-1badbb","userId":"154866f0-304f-46e2-8747-5c8d261c9839","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-28T05:04:47Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"97de8bd9-4f11-450c-bf52-4ba85a3f29c7","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-1badbb.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-1badbb/rate-test-model-1badbb\",\"requestedSubscription\":\"e2e-rate-iso-a-6deefc\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-28T05:04:47Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"97de8bd9-4f11-450c-bf52-4ba85a3f29c7","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1badbb.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-1badbb/models/facebook/opt-125m","name":"rate-test-model-1badbb","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6deefc","namespace":"ai-tenant-e2e-shared-a-1badbb","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-1badbb/rate-test-model-1badbb"}}
{"level":"debug","ts":"2026-07-28T05:04:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"97de8bd9-4f11-450c-bf52-4ba85a3f29c7","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T05:04:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"97de8bd9-4f11-450c-bf52-4ba85a3f29c7","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T05:04:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"97de8bd9-4f11-450c-bf52-4ba85a3f29c7","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T05:04:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"97de8bd9-4f11-450c-bf52-4ba85a3f29c7","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T05:04:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"97de8bd9-4f11-450c-bf52-4ba85a3f29c7","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1badbb/rate-test-model-1badbb\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-1badbb/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T05:04:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"97de8bd9-4f11-450c-bf52-4ba85a3f29c7","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-28T05:04:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"97de8bd9-4f11-450c-bf52-4ba85a3f29c7","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-6deefc"}
{"level":"debug","ts":"2026-07-28T05:04:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"97de8bd9-4f11-450c-bf52-4ba85a3f29c7","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-28T05:04:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"97de8bd9-4f11-450c-bf52-4ba85a3f29c7","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"154866f0-304f-46e2-8747-5c8d261c9839","keyName":"e2e-rate-a-6deefc","selected_subscription":"e2e-rate-iso-a-6deefc","selected_subscription_key":"ai-tenant-e2e-shared-a-1badbb/e2e-rate-iso-a-6deefc@ai-tenant-e2e-shared-a-1badbb/rate-test-model-1badbb","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-1badbb/models/facebook/opt-125m","name":"rate-test-model-1badbb","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6deefc","namespace":"ai-tenant-e2e-shared-a-1badbb","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-1badbb/rate-test-model-1badbb"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-28T05:04:47Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"97de8bd9-4f11-450c-bf52-4ba85a3f29c7","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-28T05:04:47Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"97de8bd9-4f11-450c-bf52-4ba85a3f29c7","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-28T05:04:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"17d24a93-193b-4b89-8c9d-515c16e859ac","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:60392","PortSpecifier":{"PortValue":60392}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.82:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"17d24a93-193b-4b89-8c9d-515c16e859ac","method":"POST","path":"/ai-tenant-e2e-shared-a-1badbb/rate-test-model-1badbb/v1/completions","host":"e2e-shared-a-1badbb.apps.4b968787-e1ff-4996-be24-1047ba8bf1d6.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-28T05:04:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"17d24a93-193b-4b89-8c9d-515c16e859ac","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:60392","PortSpecifier":{"PortValue":60392}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.82:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785215089,"nanos":32960733},"http":{"id":"17d24a93-193b-4b89-8c9d-515c16e859ac","method":"POST","headers":{":authority":"e2e-shared-a-1badbb.apps.4b968787-e1ff-4996-be24-1047ba8bf1d6.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-1badbb/rate-test-model-1badbb/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T05:04:49Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"17d24a93-193b-4b89-8c9d-515c16e859ac","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1boP35Ei853FTE9s5_yT4Okhlc4VG1H5nldlGFwKKkNCXPHAa2i58tsdaX8Jy"}
{"level":"debug","ts":"2026-07-28T05:04:49Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"17d24a93-193b-4b89-8c9d-515c16e859ac","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-1badbb.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1boP35Ei853FTE9s5_yT4Okhlc4VG1H5nldlGFwKKkNCXPHAa2i58tsdaX8Jy\"}"}
{"level":"debug","ts":"2026-07-28T05:04:49Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"17d24a93-193b-4b89-8c9d-515c16e859ac","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1badbb.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"154866f0-304f-46e2-8747-5c8d261c9839","keyName":"e2e-rate-a-6deefc","subscription":"e2e-rate-iso-a-6deefc","tenant":"e2e-shared-a-1badbb","userId":"154866f0-304f-46e2-8747-5c8d261c9839","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-28T05:04:49Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"17d24a93-193b-4b89-8c9d-515c16e859ac","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-1badbb.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-1badbb/rate-test-model-1badbb\",\"requestedSubscription\":\"e2e-rate-iso-a-6deefc\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-28T05:04:49Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"17d24a93-193b-4b89-8c9d-515c16e859ac","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1badbb.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-1badbb/models/facebook/opt-125m","name":"rate-test-model-1badbb","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6deefc","namespace":"ai-tenant-e2e-shared-a-1badbb","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-1badbb/rate-test-model-1badbb"}}
{"level":"debug","ts":"2026-07-28T05:04:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"17d24a93-193b-4b89-8c9d-515c16e859ac","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T05:04:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"17d24a93-193b-4b89-8c9d-515c16e859ac","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T05:04:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"17d24a93-193b-4b89-8c9d-515c16e859ac","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T05:04:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"17d24a93-193b-4b89-8c9d-515c16e859ac","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1badbb/rate-test-model-1badbb\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-1badbb/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T05:04:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"17d24a93-193b-4b89-8c9d-515c16e859ac","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T05:04:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"17d24a93-193b-4b89-8c9d-515c16e859ac","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-6deefc"}
{"level":"debug","ts":"2026-07-28T05:04:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"17d24a93-193b-4b89-8c9d-515c16e859ac","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-28T05:04:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"17d24a93-193b-4b89-8c9d-515c16e859ac","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-28T05:04:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"17d24a93-193b-4b89-8c9d-515c16e859ac","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"154866f0-304f-46e2-8747-5c8d261c9839","keyName":"e2e-rate-a-6deefc","selected_subscription":"e2e-rate-iso-a-6deefc","selected_subscription_key":"ai-tenant-e2e-shared-a-1badbb/e2e-rate-iso-a-6deefc@ai-tenant-e2e-shared-a-1badbb/rate-test-model-1badbb","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-1badbb/models/facebook/opt-125m","name":"rate-test-model-1badbb","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6deefc","namespace":"ai-tenant-e2e-shared-a-1badbb","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-1badbb/rate-test-model-1badbb"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-28T05:04:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"17d24a93-193b-4b89-8c9d-515c16e859ac","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-28T05:04:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"17d24a93-193b-4b89-8c9d-515c16e859ac","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-28T05:04:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9f50f69d-15ee-43ca-aa75-e6f6db088e47","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:60408","PortSpecifier":{"PortValue":60408}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.82:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9f50f69d-15ee-43ca-aa75-e6f6db088e47","method":"POST","path":"/ai-tenant-e2e-shared-a-1badbb/rate-test-model-1badbb/v1/completions","host":"e2e-shared-a-1badbb.apps.4b968787-e1ff-4996-be24-1047ba8bf1d6.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-28T05:04:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9f50f69d-15ee-43ca-aa75-e6f6db088e47","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:60408","PortSpecifier":{"PortValue":60408}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.82:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785215090,"nanos":75205260},"http":{"id":"9f50f69d-15ee-43ca-aa75-e6f6db088e47","method":"POST","headers":{":authority":"e2e-shared-a-1badbb.apps.4b968787-e1ff-4996-be24-1047ba8bf1d6.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-1badbb/rate-test-model-1badbb/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T05:04:50Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9f50f69d-15ee-43ca-aa75-e6f6db088e47","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1boP35Ei853FTE9s5_yT4Okhlc4VG1H5nldlGFwKKkNCXPHAa2i58tsdaX8Jy"}
{"level":"debug","ts":"2026-07-28T05:04:50Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9f50f69d-15ee-43ca-aa75-e6f6db088e47","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-1badbb.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1boP35Ei853FTE9s5_yT4Okhlc4VG1H5nldlGFwKKkNCXPHAa2i58tsdaX8Jy\"}"}
{"level":"debug","ts":"2026-07-28T05:04:50Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9f50f69d-15ee-43ca-aa75-e6f6db088e47","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1badbb.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"154866f0-304f-46e2-8747-5c8d261c9839","keyName":"e2e-rate-a-6deefc","subscription":"e2e-rate-iso-a-6deefc","tenant":"e2e-shared-a-1badbb","userId":"154866f0-304f-46e2-8747-5c8d261c9839","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-28T05:04:50Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9f50f69d-15ee-43ca-aa75-e6f6db088e47","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-1badbb.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-1badbb/rate-test-model-1badbb\",\"requestedSubscription\":\"e2e-rate-iso-a-6deefc\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-28T05:04:50Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9f50f69d-15ee-43ca-aa75-e6f6db088e47","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1badbb.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-1badbb/models/facebook/opt-125m","name":"rate-test-model-1badbb","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6deefc","namespace":"ai-tenant-e2e-shared-a-1badbb","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-1badbb/rate-test-model-1badbb"}}
{"level":"debug","ts":"2026-07-28T05:04:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9f50f69d-15ee-43ca-aa75-e6f6db088e47","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T05:04:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9f50f69d-15ee-43ca-aa75-e6f6db088e47","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T05:04:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9f50f69d-15ee-43ca-aa75-e6f6db088e47","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T05:04:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9f50f69d-15ee-43ca-aa75-e6f6db088e47","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1badbb/rate-test-model-1badbb\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-1badbb/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T05:04:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9f50f69d-15ee-43ca-aa75-e6f6db088e47","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T05:04:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9f50f69d-15ee-43ca-aa75-e6f6db088e47","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-28T05:04:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9f50f69d-15ee-43ca-aa75-e6f6db088e47","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-6deefc"}
{"level":"debug","ts":"2026-07-28T05:04:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9f50f69d-15ee-43ca-aa75-e6f6db088e47","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-28T05:04:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9f50f69d-15ee-43ca-aa75-e6f6db088e47","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"154866f0-304f-46e2-8747-5c8d261c9839","keyName":"e2e-rate-a-6deefc","selected_subscription":"e2e-rate-iso-a-6deefc","selected_subscription_key":"ai-tenant-e2e-shared-a-1badbb/e2e-rate-iso-a-6deefc@ai-tenant-e2e-shared-a-1badbb/rate-test-model-1badbb","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-1badbb/models/facebook/opt-125m","name":"rate-test-model-1badbb","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6deefc","namespace":"ai-tenant-e2e-shared-a-1badbb","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-1badbb/rate-test-model-1badbb"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-28T05:04:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9f50f69d-15ee-43ca-aa75-e6f6db088e47","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-28T05:04:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9f50f69d-15ee-43ca-aa75-e6f6db088e47","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-28T05:04:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8ffd8bb9-30fc-4dfe-93b1-1c0677ba06dc","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:60424","PortSpecifier":{"PortValue":60424}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.82:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"8ffd8bb9-30fc-4dfe-93b1-1c0677ba06dc","method":"POST","path":"/ai-tenant-e2e-shared-a-1badbb/rate-test-model-1badbb/v1/completions","host":"e2e-shared-a-1badbb.apps.4b968787-e1ff-4996-be24-1047ba8bf1d6.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-28T05:04:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8ffd8bb9-30fc-4dfe-93b1-1c0677ba06dc","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:60424","PortSpecifier":{"PortValue":60424}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.82:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785215091,"nanos":120639719},"http":{"id":"8ffd8bb9-30fc-4dfe-93b1-1c0677ba06dc","method":"POST","headers":{":authority":"e2e-shared-a-1badbb.apps.4b968787-e1ff-4996-be24-1047ba8bf1d6.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-1badbb/rate-test-model-1badbb/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T05:04:51Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"8ffd8bb9-30fc-4dfe-93b1-1c0677ba06dc","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1boP35Ei853FTE9s5_yT4Okhlc4VG1H5nldlGFwKKkNCXPHAa2i58tsdaX8Jy"}
{"level":"debug","ts":"2026-07-28T05:04:51Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"8ffd8bb9-30fc-4dfe-93b1-1c0677ba06dc","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-1badbb.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1boP35Ei853FTE9s5_yT4Okhlc4VG1H5nldlGFwKKkNCXPHAa2i58tsdaX8Jy\"}"}
{"level":"debug","ts":"2026-07-28T05:04:51Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"8ffd8bb9-30fc-4dfe-93b1-1c0677ba06dc","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1badbb.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"154866f0-304f-46e2-8747-5c8d261c9839","keyName":"e2e-rate-a-6deefc","subscription":"e2e-rate-iso-a-6deefc","tenant":"e2e-shared-a-1badbb","userId":"154866f0-304f-46e2-8747-5c8d261c9839","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-28T05:04:51Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"8ffd8bb9-30fc-4dfe-93b1-1c0677ba06dc","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-1badbb.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-1badbb/rate-test-model-1badbb\",\"requestedSubscription\":\"e2e-rate-iso-a-6deefc\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-28T05:04:51Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"8ffd8bb9-30fc-4dfe-93b1-1c0677ba06dc","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1badbb.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-1badbb/models/facebook/opt-125m","name":"rate-test-model-1badbb","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6deefc","namespace":"ai-tenant-e2e-shared-a-1badbb","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-1badbb/rate-test-model-1badbb"}}
{"level":"debug","ts":"2026-07-28T05:04:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"8ffd8bb9-30fc-4dfe-93b1-1c0677ba06dc","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T05:04:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8ffd8bb9-30fc-4dfe-93b1-1c0677ba06dc","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T05:04:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8ffd8bb9-30fc-4dfe-93b1-1c0677ba06dc","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T05:04:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8ffd8bb9-30fc-4dfe-93b1-1c0677ba06dc","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T05:04:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8ffd8bb9-30fc-4dfe-93b1-1c0677ba06dc","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1badbb/rate-test-model-1badbb\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-1badbb/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T05:04:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8ffd8bb9-30fc-4dfe-93b1-1c0677ba06dc","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-28T05:04:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8ffd8bb9-30fc-4dfe-93b1-1c0677ba06dc","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-28T05:04:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8ffd8bb9-30fc-4dfe-93b1-1c0677ba06dc","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-6deefc"}
{"level":"debug","ts":"2026-07-28T05:04:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8ffd8bb9-30fc-4dfe-93b1-1c0677ba06dc","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"154866f0-304f-46e2-8747-5c8d261c9839","keyName":"e2e-rate-a-6deefc","selected_subscription":"e2e-rate-iso-a-6deefc","selected_subscription_key":"ai-tenant-e2e-shared-a-1badbb/e2e-rate-iso-a-6deefc@ai-tenant-e2e-shared-a-1badbb/rate-test-model-1badbb","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-1badbb/models/facebook/opt-125m","name":"rate-test-model-1badbb","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6deefc","namespace":"ai-tenant-e2e-shared-a-1badbb","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-1badbb/rate-test-model-1badbb"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-28T05:04:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8ffd8bb9-30fc-4dfe-93b1-1c0677ba06dc","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-28T05:04:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8ffd8bb9-30fc-4dfe-93b1-1c0677ba06dc","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-28T05:04:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2a49d0a6-5342-45ec-957c-e53b376e0264","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:60430","PortSpecifier":{"PortValue":60430}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.82:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2a49d0a6-5342-45ec-957c-e53b376e0264","method":"POST","path":"/ai-tenant-e2e-shared-a-1badbb/rate-test-model-1badbb/v1/completions","host":"e2e-shared-a-1badbb.apps.4b968787-e1ff-4996-be24-1047ba8bf1d6.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-28T05:04:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2a49d0a6-5342-45ec-957c-e53b376e0264","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:60430","PortSpecifier":{"PortValue":60430}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.82:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785215092,"nanos":159542630},"http":{"id":"2a49d0a6-5342-45ec-957c-e53b376e0264","method":"POST","headers":{":authority":"e2e-shared-a-1badbb.apps.4b968787-e1ff-4996-be24-1047ba8bf1d6.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-1badbb/rate-test-model-1badbb/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T05:04:52Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2a49d0a6-5342-45ec-957c-e53b376e0264","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1boP35Ei853FTE9s5_yT4Okhlc4VG1H5nldlGFwKKkNCXPHAa2i58tsdaX8Jy"}
{"level":"debug","ts":"2026-07-28T05:04:52Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2a49d0a6-5342-45ec-957c-e53b376e0264","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-1badbb.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1boP35Ei853FTE9s5_yT4Okhlc4VG1H5nldlGFwKKkNCXPHAa2i58tsdaX8Jy\"}"}
{"level":"debug","ts":"2026-07-28T05:04:52Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2a49d0a6-5342-45ec-957c-e53b376e0264","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1badbb.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"154866f0-304f-46e2-8747-5c8d261c9839","keyName":"e2e-rate-a-6deefc","subscription":"e2e-rate-iso-a-6deefc","tenant":"e2e-shared-a-1badbb","userId":"154866f0-304f-46e2-8747-5c8d261c9839","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-28T05:04:52Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2a49d0a6-5342-45ec-957c-e53b376e0264","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-1badbb.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-1badbb/rate-test-model-1badbb\",\"requestedSubscription\":\"e2e-rate-iso-a-6deefc\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-28T05:04:52Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2a49d0a6-5342-45ec-957c-e53b376e0264","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1badbb.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-1badbb/models/facebook/opt-125m","name":"rate-test-model-1badbb","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6deefc","namespace":"ai-tenant-e2e-shared-a-1badbb","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-1badbb/rate-test-model-1badbb"}}
{"level":"debug","ts":"2026-07-28T05:04:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2a49d0a6-5342-45ec-957c-e53b376e0264","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T05:04:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2a49d0a6-5342-45ec-957c-e53b376e0264","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T05:04:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2a49d0a6-5342-45ec-957c-e53b376e0264","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T05:04:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2a49d0a6-5342-45ec-957c-e53b376e0264","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T05:04:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2a49d0a6-5342-45ec-957c-e53b376e0264","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1badbb/rate-test-model-1badbb\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-1badbb/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T05:04:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2a49d0a6-5342-45ec-957c-e53b376e0264","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-28T05:04:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2a49d0a6-5342-45ec-957c-e53b376e0264","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-6deefc"}
{"level":"debug","ts":"2026-07-28T05:04:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2a49d0a6-5342-45ec-957c-e53b376e0264","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-28T05:04:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2a49d0a6-5342-45ec-957c-e53b376e0264","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"154866f0-304f-46e2-8747-5c8d261c9839","keyName":"e2e-rate-a-6deefc","selected_subscription":"e2e-rate-iso-a-6deefc","selected_subscription_key":"ai-tenant-e2e-shared-a-1badbb/e2e-rate-iso-a-6deefc@ai-tenant-e2e-shared-a-1badbb/rate-test-model-1badbb","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-1badbb/models/facebook/opt-125m","name":"rate-test-model-1badbb","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6deefc","namespace":"ai-tenant-e2e-shared-a-1badbb","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-1badbb/rate-test-model-1badbb"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-28T05:04:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2a49d0a6-5342-45ec-957c-e53b376e0264","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-28T05:04:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2a49d0a6-5342-45ec-957c-e53b376e0264","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-28T05:04:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"786eb7a4-d0bc-49cb-9cb4-9e0ffd57ada7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:60444","PortSpecifier":{"PortValue":60444}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.82:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"786eb7a4-d0bc-49cb-9cb4-9e0ffd57ada7","method":"POST","path":"/ai-tenant-e2e-shared-a-1badbb/rate-test-model-1badbb/v1/completions","host":"e2e-shared-a-1badbb.apps.4b968787-e1ff-4996-be24-1047ba8bf1d6.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-28T05:04:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"786eb7a4-d0bc-49cb-9cb4-9e0ffd57ada7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:60444","PortSpecifier":{"PortValue":60444}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.82:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785215093,"nanos":208651198},"http":{"id":"786eb7a4-d0bc-49cb-9cb4-9e0ffd57ada7","method":"POST","headers":{":authority":"e2e-shared-a-1badbb.apps.4b968787-e1ff-4996-be24-1047ba8bf1d6.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-1badbb/rate-test-model-1badbb/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T05:04:53Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"786eb7a4-d0bc-49cb-9cb4-9e0ffd57ada7","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1boP35Ei853FTE9s5_yT4Okhlc4VG1H5nldlGFwKKkNCXPHAa2i58tsdaX8Jy"}
{"level":"debug","ts":"2026-07-28T05:04:53Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"786eb7a4-d0bc-49cb-9cb4-9e0ffd57ada7","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-1badbb.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1boP35Ei853FTE9s5_yT4Okhlc4VG1H5nldlGFwKKkNCXPHAa2i58tsdaX8Jy\"}"}
{"level":"debug","ts":"2026-07-28T05:04:53Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"786eb7a4-d0bc-49cb-9cb4-9e0ffd57ada7","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1badbb.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"154866f0-304f-46e2-8747-5c8d261c9839","keyName":"e2e-rate-a-6deefc","subscription":"e2e-rate-iso-a-6deefc","tenant":"e2e-shared-a-1badbb","userId":"154866f0-304f-46e2-8747-5c8d261c9839","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-28T05:04:53Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"786eb7a4-d0bc-49cb-9cb4-9e0ffd57ada7","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-1badbb.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-1badbb/rate-test-model-1badbb\",\"requestedSubscription\":\"e2e-rate-iso-a-6deefc\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-28T05:04:53Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"786eb7a4-d0bc-49cb-9cb4-9e0ffd57ada7","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1badbb.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-1badbb/models/facebook/opt-125m","name":"rate-test-model-1badbb","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6deefc","namespace":"ai-tenant-e2e-shared-a-1badbb","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-1badbb/rate-test-model-1badbb"}}
{"level":"debug","ts":"2026-07-28T05:04:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"786eb7a4-d0bc-49cb-9cb4-9e0ffd57ada7","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T05:04:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"786eb7a4-d0bc-49cb-9cb4-9e0ffd57ada7","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T05:04:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"786eb7a4-d0bc-49cb-9cb4-9e0ffd57ada7","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T05:04:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"786eb7a4-d0bc-49cb-9cb4-9e0ffd57ada7","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1badbb/rate-test-model-1badbb\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-1badbb/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T05:04:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"786eb7a4-d0bc-49cb-9cb4-9e0ffd57ada7","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T05:04:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"786eb7a4-d0bc-49cb-9cb4-9e0ffd57ada7","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-6deefc"}
{"level":"debug","ts":"2026-07-28T05:04:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"786eb7a4-d0bc-49cb-9cb4-9e0ffd57ada7","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-28T05:04:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"786eb7a4-d0bc-49cb-9cb4-9e0ffd57ada7","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-28T05:04:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"786eb7a4-d0bc-49cb-9cb4-9e0ffd57ada7","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"154866f0-304f-46e2-8747-5c8d261c9839","keyName":"e2e-rate-a-6deefc","selected_subscription":"e2e-rate-iso-a-6deefc","selected_subscription_key":"ai-tenant-e2e-shared-a-1badbb/e2e-rate-iso-a-6deefc@ai-tenant-e2e-shared-a-1badbb/rate-test-model-1badbb","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-1badbb/models/facebook/opt-125m","name":"rate-test-model-1badbb","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6deefc","namespace":"ai-tenant-e2e-shared-a-1badbb","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-1badbb/rate-test-model-1badbb"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-28T05:04:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"786eb7a4-d0bc-49cb-9cb4-9e0ffd57ada7","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-28T05:04:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"786eb7a4-d0bc-49cb-9cb4-9e0ffd57ada7","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-28T05:04:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b9f77595-99d4-4863-a8f1-3bd076cb5b46","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:60452","PortSpecifier":{"PortValue":60452}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.82:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b9f77595-99d4-4863-a8f1-3bd076cb5b46","method":"POST","path":"/ai-tenant-e2e-shared-a-1badbb/rate-test-model-1badbb/v1/completions","host":"e2e-shared-a-1badbb.apps.4b968787-e1ff-4996-be24-1047ba8bf1d6.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-28T05:04:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b9f77595-99d4-4863-a8f1-3bd076cb5b46","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:60452","PortSpecifier":{"PortValue":60452}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.82:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785215094,"nanos":250190637},"http":{"id":"b9f77595-99d4-4863-a8f1-3bd076cb5b46","method":"POST","headers":{":authority":"e2e-shared-a-1badbb.apps.4b968787-e1ff-4996-be24-1047ba8bf1d6.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-1badbb/rate-test-model-1badbb/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T05:04:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b9f77595-99d4-4863-a8f1-3bd076cb5b46","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1boP35Ei853FTE9s5_yT4Okhlc4VG1H5nldlGFwKKkNCXPHAa2i58tsdaX8Jy"}
{"level":"debug","ts":"2026-07-28T05:04:54Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b9f77595-99d4-4863-a8f1-3bd076cb5b46","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-1badbb.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1boP35Ei853FTE9s5_yT4Okhlc4VG1H5nldlGFwKKkNCXPHAa2i58tsdaX8Jy\"}"}
{"level":"debug","ts":"2026-07-28T05:04:54Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b9f77595-99d4-4863-a8f1-3bd076cb5b46","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1badbb.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"154866f0-304f-46e2-8747-5c8d261c9839","keyName":"e2e-rate-a-6deefc","subscription":"e2e-rate-iso-a-6deefc","tenant":"e2e-shared-a-1badbb","userId":"154866f0-304f-46e2-8747-5c8d261c9839","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-28T05:04:54Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b9f77595-99d4-4863-a8f1-3bd076cb5b46","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-1badbb.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-1badbb/rate-test-model-1badbb\",\"requestedSubscription\":\"e2e-rate-iso-a-6deefc\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-28T05:04:54Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b9f77595-99d4-4863-a8f1-3bd076cb5b46","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1badbb.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-1badbb/models/facebook/opt-125m","name":"rate-test-model-1badbb","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6deefc","namespace":"ai-tenant-e2e-shared-a-1badbb","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-1badbb/rate-test-model-1badbb"}}
{"level":"debug","ts":"2026-07-28T05:04:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b9f77595-99d4-4863-a8f1-3bd076cb5b46","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T05:04:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b9f77595-99d4-4863-a8f1-3bd076cb5b46","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T05:04:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b9f77595-99d4-4863-a8f1-3bd076cb5b46","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T05:04:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b9f77595-99d4-4863-a8f1-3bd076cb5b46","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1badbb/rate-test-model-1badbb\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-1badbb/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T05:04:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b9f77595-99d4-4863-a8f1-3bd076cb5b46","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T05:04:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b9f77595-99d4-4863-a8f1-3bd076cb5b46","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-28T05:04:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b9f77595-99d4-4863-a8f1-3bd076cb5b46","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-6deefc"}
{"level":"debug","ts":"2026-07-28T05:04:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b9f77595-99d4-4863-a8f1-3bd076cb5b46","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-28T05:04:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b9f77595-99d4-4863-a8f1-3bd076cb5b46","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"154866f0-304f-46e2-8747-5c8d261c9839","keyName":"e2e-rate-a-6deefc","selected_subscription":"e2e-rate-iso-a-6deefc","selected_subscription_key":"ai-tenant-e2e-shared-a-1badbb/e2e-rate-iso-a-6deefc@ai-tenant-e2e-shared-a-1badbb/rate-test-model-1badbb","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-1badbb/models/facebook/opt-125m","name":"rate-test-model-1badbb","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6deefc","namespace":"ai-tenant-e2e-shared-a-1badbb","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-1badbb/rate-test-model-1badbb"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-28T05:04:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b9f77595-99d4-4863-a8f1-3bd076cb5b46","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-28T05:04:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b9f77595-99d4-4863-a8f1-3bd076cb5b46","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-28T05:04:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"297f5024-59cb-4063-a7b7-1ed1dec494a7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:40312","PortSpecifier":{"PortValue":40312}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"297f5024-59cb-4063-a7b7-1ed1dec494a7","method":"POST","path":"/ai-tenant-e2e-shared-b-92c557/rate-test-model-92c557/v1/completions","host":"e2e-shared-b-92c557.apps.4b968787-e1ff-4996-be24-1047ba8bf1d6.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-28T05:04:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"297f5024-59cb-4063-a7b7-1ed1dec494a7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:40312","PortSpecifier":{"PortValue":40312}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785215094,"nanos":284866479},"http":{"id":"297f5024-59cb-4063-a7b7-1ed1dec494a7","method":"POST","headers":{":authority":"e2e-shared-b-92c557.apps.4b968787-e1ff-4996-be24-1047ba8bf1d6.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-92c557/rate-test-model-92c557/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T05:04:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"297f5024-59cb-4063-a7b7-1ed1dec494a7","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1MHLKUHZKaG5bj6yH_aFWMHn9YFWDgdt7wdYzOvUi7X37SqoLXa3ohYZnNgpV"}
{"level":"debug","ts":"2026-07-28T05:04:54Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"297f5024-59cb-4063-a7b7-1ed1dec494a7","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-92c557.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1MHLKUHZKaG5bj6yH_aFWMHn9YFWDgdt7wdYzOvUi7X37SqoLXa3ohYZnNgpV\"}"}
{"level":"debug","ts":"2026-07-28T05:04:54Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"297f5024-59cb-4063-a7b7-1ed1dec494a7","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-92c557.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"7197356c-f1ba-40a2-937a-02b5594d0517","keyName":"e2e-rate-b-6deefc","subscription":"e2e-rate-iso-b-6deefc","tenant":"e2e-shared-b-92c557","userId":"7197356c-f1ba-40a2-937a-02b5594d0517","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-28T05:04:54Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"297f5024-59cb-4063-a7b7-1ed1dec494a7","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-92c557.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-92c557/rate-test-model-92c557\",\"requestedSubscription\":\"e2e-rate-iso-b-6deefc\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-28T05:04:54Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"297f5024-59cb-4063-a7b7-1ed1dec494a7","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-92c557.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-b-92c557/models/facebook/opt-125m","name":"rate-test-model-92c557","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-6deefc","namespace":"ai-tenant-e2e-shared-b-92c557","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-b-92c557/rate-test-model-92c557"}}
{"level":"debug","ts":"2026-07-28T05:04:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"297f5024-59cb-4063-a7b7-1ed1dec494a7","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T05:04:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"297f5024-59cb-4063-a7b7-1ed1dec494a7","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T05:04:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"297f5024-59cb-4063-a7b7-1ed1dec494a7","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T05:04:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"297f5024-59cb-4063-a7b7-1ed1dec494a7","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T05:04:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"297f5024-59cb-4063-a7b7-1ed1dec494a7","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-92c557/rate-test-model-92c557\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-92c557/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T05:04:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"297f5024-59cb-4063-a7b7-1ed1dec494a7","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-6deefc"}
{"level":"debug","ts":"2026-07-28T05:04:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"297f5024-59cb-4063-a7b7-1ed1dec494a7","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-28T05:04:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"297f5024-59cb-4063-a7b7-1ed1dec494a7","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-28T05:04:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"297f5024-59cb-4063-a7b7-1ed1dec494a7","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"7197356c-f1ba-40a2-937a-02b5594d0517","keyName":"e2e-rate-b-6deefc","selected_subscription":"e2e-rate-iso-b-6deefc","selected_subscription_key":"ai-tenant-e2e-shared-b-92c557/e2e-rate-iso-b-6deefc@ai-tenant-e2e-shared-b-92c557/rate-test-model-92c557","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-b-92c557/models/facebook/opt-125m","name":"rate-test-model-92c557","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-6deefc","namespace":"ai-tenant-e2e-shared-b-92c557","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-b-92c557/rate-test-model-92c557"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-28T05:04:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"297f5024-59cb-4063-a7b7-1ed1dec494a7","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-28T05:04:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"297f5024-59cb-4063-a7b7-1ed1dec494a7","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-28T05:04:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a18d7e0bf61c416c0459b42e95740458134ee13f954b65e8f5ef6a1652b5ed5f"}
{"level":"info","ts":"2026-07-28T05:04:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/44e262c5602216a95346bd46281613ccf8f4c1ca73a88caa78d528379b14accb"}
{"level":"info","ts":"2026-07-28T05:05:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6d7099c1757c0a2b54dd3d11328fed9be631f5e52301848eae31640397842368"}
{"level":"info","ts":"2026-07-28T05:05:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/5860cd81625d49166fecb92a60d987788627e0ae11a485e966cbd572ad59e878"}
{"level":"info","ts":"2026-07-28T05:05:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b36339b71d982fea8a734a0f938c4020b5a73de1a5e540da901bb90b9e630d30"}
{"level":"info","ts":"2026-07-28T05:05:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/94eff5baf7094338abb5238062f7ee9981b9de348005302316eb9d086a3edf8e"}
{"level":"info","ts":"2026-07-28T05:05:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3c1360578a45ae050457787afdfd3d4d40497dbb864a14b5b7a5ac889d500700"}
{"level":"info","ts":"2026-07-28T05:05:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b0f3aa885a5fa589ad40025f1f18ded2c935b92f3aea49639ada8ad9f5c8ff27"}
{"level":"info","ts":"2026-07-28T05:05:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/cf14d932303793268f3c79ed08131d44ffad52d21b0243772bf6a90d5fbb3f5f"}
{"level":"info","ts":"2026-07-28T05:05:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f7aae63da57803a17680b7cdf2f4a32929b898e72c13db90df53b6093111887f"}
{"level":"info","ts":"2026-07-28T05:05:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/51113613ac66b835090de3f41bf36b71a47adbfa165a7a1976b05aa1cb8deffa"}
{"level":"info","ts":"2026-07-28T05:05:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/cbc61d13c10873f1992d0e726efe30fcca75e0e00f43ef1964c394f09da517f4"}
{"level":"info","ts":"2026-07-28T05:05:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/50eb468358dcfde7377323477dcd79626c254ccda31ae45ae5492eab0d0ee198"}
{"level":"info","ts":"2026-07-28T05:05:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/06a2ad7625dcaf0c04bd7063876d8dbc8eda51fec5a090fbf3c41628e83d8e4e"}
{"level":"info","ts":"2026-07-28T05:05:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1d52a407cddda382099b569e7f021857dc46c9cddb2b59bb4052c39f6a397ac3"}
{"level":"info","ts":"2026-07-28T05:05:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/8b1476b0a5493c069b36c67c90989af768e539699a09d3ab8dbfebfd49fabc8f"}
{"level":"info","ts":"2026-07-28T05:05:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d5c156c24e749412a655450c3271a2dbc7efc2bb0bc578c55f717a50700a4d75"}
{"level":"info","ts":"2026-07-28T05:05:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7de1f58f29c29c140a9c61f108b76fba266782f30e91d2798a695d763b132986"}
{"level":"info","ts":"2026-07-28T05:05:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/951f16f9f63044832fb7cca2f9efb5a7e8323b023615092ec930681fe96cb496"}
{"level":"info","ts":"2026-07-28T05:05:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/59eb09c4032d9dec37404d14742acd7400f4c56d9cf31873d40c8461ef70b263"}
{"level":"info","ts":"2026-07-28T05:05:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/283f817c9e4477203c25458c381a441f329ca2af86479315ae3ff4304f193aa4"}
{"level":"info","ts":"2026-07-28T05:05:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/600a82318ec3eaf929fc5123bcc64fd728da4845f8da3f4dcf038a88fd403d5e"}
{"level":"info","ts":"2026-07-28T05:05:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a2e9b2c968d393933b38024553088b99f6f10e2269eb03c6785a64abbd1ed1d8"}
{"level":"info","ts":"2026-07-28T05:05:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/749a6477787d2709c5f366303c50be1fe5f53113f4b96f6380cae86f1ff4263e"}
{"level":"info","ts":"2026-07-28T05:05:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1f18ba3a-63bd-4b07-9a96-421cc30e0abf","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:58490","PortSpecifier":{"PortValue":58490}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1f18ba3a-63bd-4b07-9a96-421cc30e0abf","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.4b968787-e1ff-4996-be24-1047ba8bf1d6.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-28T05:05:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1f18ba3a-63bd-4b07-9a96-421cc30e0abf","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:58490","PortSpecifier":{"PortValue":58490}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785215156,"nanos":905962931},"http":{"id":"1f18ba3a-63bd-4b07-9a96-421cc30e0abf","method":"POST","headers":{":authority":"maas.apps.4b968787-e1ff-4996-be24-1047ba8bf1d6.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T05:05:56Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"1f18ba3a-63bd-4b07-9a96-421cc30e0abf","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-28T05:05:56Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1f18ba3a-63bd-4b07-9a96-421cc30e0abf","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"a6220b9a-f932-4104-9d94-f7ddcf1fc828","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=36cff924-3b00-4199-a9fb-56d9bf87c328"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1047ba8bf1d6"]}}
{"level":"debug","ts":"2026-07-28T05:05:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1f18ba3a-63bd-4b07-9a96-421cc30e0abf","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1047ba8bf1d6"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=36cff924-3b00-4199-a9fb-56d9bf87c328"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"a6220b9a-f932-4104-9d94-f7ddcf1fc828","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.39:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.4b968787-e1ff-4996-be24-1047ba8bf1d6.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T05:05:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1f18ba3a-63bd-4b07-9a96-421cc30e0abf","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T05:05:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1f18ba3a-63bd-4b07-9a96-421cc30e0abf","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T05:05:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1f18ba3a-63bd-4b07-9a96-421cc30e0abf","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]},\"publishers/llm/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/llm/models/facebook/opt-125m-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T05:05:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"1f18ba3a-63bd-4b07-9a96-421cc30e0abf","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-28T05:05:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1f18ba3a-63bd-4b07-9a96-421cc30e0abf","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-28T05:05:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1f18ba3a-63bd-4b07-9a96-421cc30e0abf","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-28T05:05:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1f18ba3a-63bd-4b07-9a96-421cc30e0abf","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-28T05:05:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1f18ba3a-63bd-4b07-9a96-421cc30e0abf","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-28T05:05:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"149dcc33-18c1-473b-85fc-64a1137ff779","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:58492","PortSpecifier":{"PortValue":58492}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"149dcc33-18c1-473b-85fc-64a1137ff779","method":"POST","path":"/llm/facebook-opt-125m-simulated/v1/chat/completions","host":"maas.apps.4b968787-e1ff-4996-be24-1047ba8bf1d6.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-28T05:05:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"149dcc33-18c1-473b-85fc-64a1137ff779","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:58492","PortSpecifier":{"PortValue":58492}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785215156,"nanos":969635921},"http":{"id":"149dcc33-18c1-473b-85fc-64a1137ff779","method":"POST","headers":{":authority":"maas.apps.4b968787-e1ff-4996-be24-1047ba8bf1d6.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T05:05:56Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"149dcc33-18c1-473b-85fc-64a1137ff779","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-A12rXGo6DUTeHTQd_vf8drDyRwtUGHiYUN0kIKgylkoUAOVmAUrKstDUkdQa"}
{"level":"debug","ts":"2026-07-28T05:05:56Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"149dcc33-18c1-473b-85fc-64a1137ff779","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-A12rXGo6DUTeHTQd_vf8drDyRwtUGHiYUN0kIKgylkoUAOVmAUrKstDUkdQa\"}"}
{"level":"debug","ts":"2026-07-28T05:05:56Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"149dcc33-18c1-473b-85fc-64a1137ff779","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"024ebf8c-58a5-40c9-9e6f-80f6f8dc871a","keyName":"e2e-ipp-default","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"024ebf8c-58a5-40c9-9e6f-80f6f8dc871a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-28T05:05:56Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"149dcc33-18c1-473b-85fc-64a1137ff779","config":"subscription-info","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"simulator-subscription\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-28T05:05:56Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"149dcc33-18c1-473b-85fc-64a1137ff779","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","model_name":"publishers/llm/models/facebook/opt-125m","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true,"resolvedModel":"llm/facebook-opt-125m-simulated"}}
{"level":"debug","ts":"2026-07-28T05:05:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"149dcc33-18c1-473b-85fc-64a1137ff779","input":{"auth":{"identity":"Bearer **** subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","model_name":"publishers/llm/models/facebook/opt-125m","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true,"resolvedModel":"llm/facebook-opt-125m-simulated"}}},"context":{"context_extensions":{"host":"311b1be286674fd5684c9ac59b318287dade9769cfe4aeebd8c88e2dc6b72418"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.39:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.4b968787-e1ff-4996-be24-1047ba8bf1d6.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T05:05:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"149dcc33-18c1-473b-85fc-64a1137ff779","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T05:05:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"149dcc33-18c1-473b-85fc-64a1137ff779","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T05:05:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"149dcc33-18c1-473b-85fc-64a1137ff779","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T05:05:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"149dcc33-18c1-473b-85fc-64a1137ff779","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]},\"publishers/llm/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/llm/models/facebook/opt-125m-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T05:05:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"149dcc33-18c1-473b-85fc-64a1137ff779","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-28T05:05:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"149dcc33-18c1-473b-85fc-64a1137ff779","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-28T05:05:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"149dcc33-18c1-473b-85fc-64a1137ff779","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-28T05:05:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"149dcc33-18c1-473b-85fc-64a1137ff779","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"024ebf8c-58a5-40c9-9e6f-80f6f8dc871a","keyName":"e2e-ipp-default","selected_subscription":"simulator-subscription","selected_subscription_key":"models-as-a-service/simulator-subscription@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","model_name":"publishers/llm/models/facebook/opt-125m","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true,"resolvedModel":"llm/facebook-opt-125m-simulated"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-28T05:05:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"149dcc33-18c1-473b-85fc-64a1137ff779","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-28T05:05:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"149dcc33-18c1-473b-85fc-64a1137ff779","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d6bcc45c7b1f4b87a0e7a36c92b9fd27e92a3d08251b86c64b656eac9aff72ca","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T05:06:33Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T05:06:33Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d6bcc45c7b1f4b87a0e7a36c92b9fd27e92a3d08251b86c64b656eac9aff72ca","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d6bcc45c7b1f4b87a0e7a36c92b9fd27e92a3d08251b86c64b656eac9aff72ca","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d6bcc45c7b1f4b87a0e7a36c92b9fd27e92a3d08251b86c64b656eac9aff72ca","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d6bcc45c7b1f4b87a0e7a36c92b9fd27e92a3d08251b86c64b656eac9aff72ca"}
{"level":"debug","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d6bcc45c7b1f4b87a0e7a36c92b9fd27e92a3d08251b86c64b656eac9aff72ca","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d6bcc45c7b1f4b87a0e7a36c92b9fd27e92a3d08251b86c64b656eac9aff72ca"}
{"level":"debug","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d6bcc45c7b1f4b87a0e7a36c92b9fd27e92a3d08251b86c64b656eac9aff72ca","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T05:06:33Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T05:06:33Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d6bcc45c7b1f4b87a0e7a36c92b9fd27e92a3d08251b86c64b656eac9aff72ca"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d6bcc45c7b1f4b87a0e7a36c92b9fd27e92a3d08251b86c64b656eac9aff72ca","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"cc05fdafad3dc7b24d485590d4a2b8ea838f050122d0e5a267a4835068dd3ef2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T05:06:33Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T05:06:33Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"cc05fdafad3dc7b24d485590d4a2b8ea838f050122d0e5a267a4835068dd3ef2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d6bcc45c7b1f4b87a0e7a36c92b9fd27e92a3d08251b86c64b656eac9aff72ca","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cc05fdafad3dc7b24d485590d4a2b8ea838f050122d0e5a267a4835068dd3ef2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cc05fdafad3dc7b24d485590d4a2b8ea838f050122d0e5a267a4835068dd3ef2","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cc05fdafad3dc7b24d485590d4a2b8ea838f050122d0e5a267a4835068dd3ef2"}
{"level":"debug","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"cc05fdafad3dc7b24d485590d4a2b8ea838f050122d0e5a267a4835068dd3ef2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T05:06:33Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T05:06:33Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["cc05fdafad3dc7b24d485590d4a2b8ea838f050122d0e5a267a4835068dd3ef2"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d6bcc45c7b1f4b87a0e7a36c92b9fd27e92a3d08251b86c64b656eac9aff72ca"}
{"level":"info","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"cc05fdafad3dc7b24d485590d4a2b8ea838f050122d0e5a267a4835068dd3ef2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"cc05fdafad3dc7b24d485590d4a2b8ea838f050122d0e5a267a4835068dd3ef2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T05:06:33Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T05:06:33Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cc05fdafad3dc7b24d485590d4a2b8ea838f050122d0e5a267a4835068dd3ef2"}
{"level":"info","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"cc05fdafad3dc7b24d485590d4a2b8ea838f050122d0e5a267a4835068dd3ef2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cc05fdafad3dc7b24d485590d4a2b8ea838f050122d0e5a267a4835068dd3ef2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cc05fdafad3dc7b24d485590d4a2b8ea838f050122d0e5a267a4835068dd3ef2","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cc05fdafad3dc7b24d485590d4a2b8ea838f050122d0e5a267a4835068dd3ef2"}
{"level":"debug","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cc05fdafad3dc7b24d485590d4a2b8ea838f050122d0e5a267a4835068dd3ef2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a0b3be065eb20c0fbcb2f77a15d4b18c323a342bc1f5fb515fdc31ff93c0f438","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T05:06:33Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T05:06:33Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cc05fdafad3dc7b24d485590d4a2b8ea838f050122d0e5a267a4835068dd3ef2"}
{"level":"info","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a0b3be065eb20c0fbcb2f77a15d4b18c323a342bc1f5fb515fdc31ff93c0f438","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a0b3be065eb20c0fbcb2f77a15d4b18c323a342bc1f5fb515fdc31ff93c0f438","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T05:06:33Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T05:06:33Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a0b3be065eb20c0fbcb2f77a15d4b18c323a342bc1f5fb515fdc31ff93c0f438"}
{"level":"info","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a0b3be065eb20c0fbcb2f77a15d4b18c323a342bc1f5fb515fdc31ff93c0f438","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a0b3be065eb20c0fbcb2f77a15d4b18c323a342bc1f5fb515fdc31ff93c0f438","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T05:06:33Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T05:06:33Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"a0b3be065eb20c0fbcb2f77a15d4b18c323a342bc1f5fb515fdc31ff93c0f438","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a0b3be065eb20c0fbcb2f77a15d4b18c323a342bc1f5fb515fdc31ff93c0f438\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"cc05fdafad3dc7b24d485590d4a2b8ea838f050122d0e5a267a4835068dd3ef2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T05:06:33Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T05:06:33Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["cc05fdafad3dc7b24d485590d4a2b8ea838f050122d0e5a267a4835068dd3ef2"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"cc05fdafad3dc7b24d485590d4a2b8ea838f050122d0e5a267a4835068dd3ef2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a0b3be065eb20c0fbcb2f77a15d4b18c323a342bc1f5fb515fdc31ff93c0f438","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a0b3be065eb20c0fbcb2f77a15d4b18c323a342bc1f5fb515fdc31ff93c0f438"}
{"level":"debug","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cc05fdafad3dc7b24d485590d4a2b8ea838f050122d0e5a267a4835068dd3ef2","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a0b3be065eb20c0fbcb2f77a15d4b18c323a342bc1f5fb515fdc31ff93c0f438"}
{"level":"debug","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a0b3be065eb20c0fbcb2f77a15d4b18c323a342bc1f5fb515fdc31ff93c0f438","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T05:06:33Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T05:06:33Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a0b3be065eb20c0fbcb2f77a15d4b18c323a342bc1f5fb515fdc31ff93c0f438"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cc05fdafad3dc7b24d485590d4a2b8ea838f050122d0e5a267a4835068dd3ef2"}
{"level":"info","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a0b3be065eb20c0fbcb2f77a15d4b18c323a342bc1f5fb515fdc31ff93c0f438","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c29f98beaf784330acdcd8a8d5e5786fb9804f6d99127b7d705a0058fd724160","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T05:06:33Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T05:06:33Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c29f98beaf784330acdcd8a8d5e5786fb9804f6d99127b7d705a0058fd724160","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a0b3be065eb20c0fbcb2f77a15d4b18c323a342bc1f5fb515fdc31ff93c0f438","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c29f98beaf784330acdcd8a8d5e5786fb9804f6d99127b7d705a0058fd724160","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c29f98beaf784330acdcd8a8d5e5786fb9804f6d99127b7d705a0058fd724160"}
{"level":"debug","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c29f98beaf784330acdcd8a8d5e5786fb9804f6d99127b7d705a0058fd724160","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T05:06:33Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T05:06:33Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c29f98beaf784330acdcd8a8d5e5786fb9804f6d99127b7d705a0058fd724160"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c29f98beaf784330acdcd8a8d5e5786fb9804f6d99127b7d705a0058fd724160","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c29f98beaf784330acdcd8a8d5e5786fb9804f6d99127b7d705a0058fd724160","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a0b3be065eb20c0fbcb2f77a15d4b18c323a342bc1f5fb515fdc31ff93c0f438"}
{"level":"info","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c29f98beaf784330acdcd8a8d5e5786fb9804f6d99127b7d705a0058fd724160"}
{"level":"debug","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"608ce3f20a3b67084b126ac5ac0847da296f174174e92f39318d1990bc1096ae","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T05:06:33Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T05:06:33Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"608ce3f20a3b67084b126ac5ac0847da296f174174e92f39318d1990bc1096ae","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"608ce3f20a3b67084b126ac5ac0847da296f174174e92f39318d1990bc1096ae","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"608ce3f20a3b67084b126ac5ac0847da296f174174e92f39318d1990bc1096ae","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/608ce3f20a3b67084b126ac5ac0847da296f174174e92f39318d1990bc1096ae"}
{"level":"debug","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"608ce3f20a3b67084b126ac5ac0847da296f174174e92f39318d1990bc1096ae","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/608ce3f20a3b67084b126ac5ac0847da296f174174e92f39318d1990bc1096ae"}
{"level":"debug","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"608ce3f20a3b67084b126ac5ac0847da296f174174e92f39318d1990bc1096ae","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T05:06:33Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T05:06:33Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["608ce3f20a3b67084b126ac5ac0847da296f174174e92f39318d1990bc1096ae"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"608ce3f20a3b67084b126ac5ac0847da296f174174e92f39318d1990bc1096ae","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"608ce3f20a3b67084b126ac5ac0847da296f174174e92f39318d1990bc1096ae","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T05:06:33Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T05:06:33Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"608ce3f20a3b67084b126ac5ac0847da296f174174e92f39318d1990bc1096ae","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"55e4fda286cd2427522f272d9e4b13d0380bac860e3a2f0afe4effd546f635f6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T05:06:33Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T05:06:33Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"55e4fda286cd2427522f272d9e4b13d0380bac860e3a2f0afe4effd546f635f6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"608ce3f20a3b67084b126ac5ac0847da296f174174e92f39318d1990bc1096ae","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/608ce3f20a3b67084b126ac5ac0847da296f174174e92f39318d1990bc1096ae"}
{"level":"debug","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"55e4fda286cd2427522f272d9e4b13d0380bac860e3a2f0afe4effd546f635f6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T05:06:33Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T05:06:33Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"55e4fda286cd2427522f272d9e4b13d0380bac860e3a2f0afe4effd546f635f6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"608ce3f20a3b67084b126ac5ac0847da296f174174e92f39318d1990bc1096ae","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T05:06:33Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T05:06:33Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["608ce3f20a3b67084b126ac5ac0847da296f174174e92f39318d1990bc1096ae"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/55e4fda286cd2427522f272d9e4b13d0380bac860e3a2f0afe4effd546f635f6"}
{"level":"info","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"608ce3f20a3b67084b126ac5ac0847da296f174174e92f39318d1990bc1096ae","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"55e4fda286cd2427522f272d9e4b13d0380bac860e3a2f0afe4effd546f635f6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T05:06:33Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T05:06:33Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["55e4fda286cd2427522f272d9e4b13d0380bac860e3a2f0afe4effd546f635f6"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"55e4fda286cd2427522f272d9e4b13d0380bac860e3a2f0afe4effd546f635f6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"608ce3f20a3b67084b126ac5ac0847da296f174174e92f39318d1990bc1096ae","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T05:06:33Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T05:06:33Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/608ce3f20a3b67084b126ac5ac0847da296f174174e92f39318d1990bc1096ae"}
{"level":"info","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"608ce3f20a3b67084b126ac5ac0847da296f174174e92f39318d1990bc1096ae","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"55e4fda286cd2427522f272d9e4b13d0380bac860e3a2f0afe4effd546f635f6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T05:06:33Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T05:06:33Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"55e4fda286cd2427522f272d9e4b13d0380bac860e3a2f0afe4effd546f635f6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"608ce3f20a3b67084b126ac5ac0847da296f174174e92f39318d1990bc1096ae","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T05:06:33Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T05:06:33Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["608ce3f20a3b67084b126ac5ac0847da296f174174e92f39318d1990bc1096ae"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/55e4fda286cd2427522f272d9e4b13d0380bac860e3a2f0afe4effd546f635f6"}
{"level":"info","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"608ce3f20a3b67084b126ac5ac0847da296f174174e92f39318d1990bc1096ae","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"55e4fda286cd2427522f272d9e4b13d0380bac860e3a2f0afe4effd546f635f6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T05:06:33Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T05:06:33Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["55e4fda286cd2427522f272d9e4b13d0380bac860e3a2f0afe4effd546f635f6"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"55e4fda286cd2427522f272d9e4b13d0380bac860e3a2f0afe4effd546f635f6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"941d0249afb4adb352185deca07a0a1b7060fe727112c271fe3493bafdade285","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T05:06:33Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T05:06:33Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/608ce3f20a3b67084b126ac5ac0847da296f174174e92f39318d1990bc1096ae"}
{"level":"info","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"941d0249afb4adb352185deca07a0a1b7060fe727112c271fe3493bafdade285","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"608ce3f20a3b67084b126ac5ac0847da296f174174e92f39318d1990bc1096ae","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"55e4fda286cd2427522f272d9e4b13d0380bac860e3a2f0afe4effd546f635f6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T05:06:33Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T05:06:33Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"55e4fda286cd2427522f272d9e4b13d0380bac860e3a2f0afe4effd546f635f6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"941d0249afb4adb352185deca07a0a1b7060fe727112c271fe3493bafdade285","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"55e4fda286cd2427522f272d9e4b13d0380bac860e3a2f0afe4effd546f635f6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"55e4fda286cd2427522f272d9e4b13d0380bac860e3a2f0afe4effd546f635f6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"941d0249afb4adb352185deca07a0a1b7060fe727112c271fe3493bafdade285","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/55e4fda286cd2427522f272d9e4b13d0380bac860e3a2f0afe4effd546f635f6"}
{"level":"debug","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"55e4fda286cd2427522f272d9e4b13d0380bac860e3a2f0afe4effd546f635f6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T05:06:33Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T05:06:33Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["55e4fda286cd2427522f272d9e4b13d0380bac860e3a2f0afe4effd546f635f6"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"55e4fda286cd2427522f272d9e4b13d0380bac860e3a2f0afe4effd546f635f6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"941d0249afb4adb352185deca07a0a1b7060fe727112c271fe3493bafdade285","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T05:06:33Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T05:06:33Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/941d0249afb4adb352185deca07a0a1b7060fe727112c271fe3493bafdade285"}
{"level":"info","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"941d0249afb4adb352185deca07a0a1b7060fe727112c271fe3493bafdade285","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"55e4fda286cd2427522f272d9e4b13d0380bac860e3a2f0afe4effd546f635f6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"941d0249afb4adb352185deca07a0a1b7060fe727112c271fe3493bafdade285","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T05:06:33Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T05:06:33Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["941d0249afb4adb352185deca07a0a1b7060fe727112c271fe3493bafdade285"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"941d0249afb4adb352185deca07a0a1b7060fe727112c271fe3493bafdade285","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"941d0249afb4adb352185deca07a0a1b7060fe727112c271fe3493bafdade285","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/608ce3f20a3b67084b126ac5ac0847da296f174174e92f39318d1990bc1096ae"}
{"level":"debug","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"941d0249afb4adb352185deca07a0a1b7060fe727112c271fe3493bafdade285","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/55e4fda286cd2427522f272d9e4b13d0380bac860e3a2f0afe4effd546f635f6"}
{"level":"info","ts":"2026-07-28T05:06:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/941d0249afb4adb352185deca07a0a1b7060fe727112c271fe3493bafdade285"}
{"level":"debug","ts":"2026-07-28T05:06:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f4f105677adb6d24d95b24eb8ac4221664ffa268c9db7660b1afdbb881f262c5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T05:06:34Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T05:06:34Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T05:06:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f4f105677adb6d24d95b24eb8ac4221664ffa268c9db7660b1afdbb881f262c5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T05:06:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f4f105677adb6d24d95b24eb8ac4221664ffa268c9db7660b1afdbb881f262c5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T05:06:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f4f105677adb6d24d95b24eb8ac4221664ffa268c9db7660b1afdbb881f262c5","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-28T05:06:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f4f105677adb6d24d95b24eb8ac4221664ffa268c9db7660b1afdbb881f262c5"}
{"level":"debug","ts":"2026-07-28T05:06:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f4f105677adb6d24d95b24eb8ac4221664ffa268c9db7660b1afdbb881f262c5","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-28T05:06:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f4f105677adb6d24d95b24eb8ac4221664ffa268c9db7660b1afdbb881f262c5"}
{"level":"debug","ts":"2026-07-28T05:06:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f4f105677adb6d24d95b24eb8ac4221664ffa268c9db7660b1afdbb881f262c5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T05:06:34Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T05:06:34Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["f4f105677adb6d24d95b24eb8ac4221664ffa268c9db7660b1afdbb881f262c5"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T05:06:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f4f105677adb6d24d95b24eb8ac4221664ffa268c9db7660b1afdbb881f262c5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T05:06:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f4f105677adb6d24d95b24eb8ac4221664ffa268c9db7660b1afdbb881f262c5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T05:06:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"18519e445f8ddabb9bac24a9b959714898baa53b665e22a79f80b1a044699c78","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T05:06:34Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T05:06:34Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T05:06:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"18519e445f8ddabb9bac24a9b959714898baa53b665e22a79f80b1a044699c78","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T05:06:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"18519e445f8ddabb9bac24a9b959714898baa53b665e22a79f80b1a044699c78","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T05:06:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"18519e445f8ddabb9bac24a9b959714898baa53b665e22a79f80b1a044699c78","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-28T05:06:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f4f105677adb6d24d95b24eb8ac4221664ffa268c9db7660b1afdbb881f262c5"}
{"level":"debug","ts":"2026-07-28T05:06:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"18519e445f8ddabb9bac24a9b959714898baa53b665e22a79f80b1a044699c78","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T05:06:34Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T05:06:34Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T05:06:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/18519e445f8ddabb9bac24a9b959714898baa53b665e22a79f80b1a044699c78"}
{"level":"info","ts":"2026-07-28T05:06:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"18519e445f8ddabb9bac24a9b959714898baa53b665e22a79f80b1a044699c78","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T05:06:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"18519e445f8ddabb9bac24a9b959714898baa53b665e22a79f80b1a044699c78","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T05:06:34Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T05:06:34Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["18519e445f8ddabb9bac24a9b959714898baa53b665e22a79f80b1a044699c78"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T05:06:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"18519e445f8ddabb9bac24a9b959714898baa53b665e22a79f80b1a044699c78","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T05:06:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"18519e445f8ddabb9bac24a9b959714898baa53b665e22a79f80b1a044699c78","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T05:06:34Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T05:06:34Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T05:06:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"18519e445f8ddabb9bac24a9b959714898baa53b665e22a79f80b1a044699c78","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T05:06:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"18519e445f8ddabb9bac24a9b959714898baa53b665e22a79f80b1a044699c78","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T05:06:34Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T05:06:34Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-28T05:06:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"18519e445f8ddabb9bac24a9b959714898baa53b665e22a79f80b1a044699c78","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"18519e445f8ddabb9bac24a9b959714898baa53b665e22a79f80b1a044699c78\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-28T05:06:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"47ff210100a25eae2fbb80e3ea3052c175d033b262db2822be0a877e1759ff86","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T05:06:34Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T05:06:34Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T05:06:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/18519e445f8ddabb9bac24a9b959714898baa53b665e22a79f80b1a044699c78"}
{"level":"info","ts":"2026-07-28T05:06:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"47ff210100a25eae2fbb80e3ea3052c175d033b262db2822be0a877e1759ff86","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T05:06:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"18519e445f8ddabb9bac24a9b959714898baa53b665e22a79f80b1a044699c78","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T05:06:34Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T05:06:34Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["18519e445f8ddabb9bac24a9b959714898baa53b665e22a79f80b1a044699c78"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T05:06:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"18519e445f8ddabb9bac24a9b959714898baa53b665e22a79f80b1a044699c78","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T05:06:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"47ff210100a25eae2fbb80e3ea3052c175d033b262db2822be0a877e1759ff86","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T05:06:34Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T05:06:34Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T05:06:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"47ff210100a25eae2fbb80e3ea3052c175d033b262db2822be0a877e1759ff86","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T05:06:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"18519e445f8ddabb9bac24a9b959714898baa53b665e22a79f80b1a044699c78","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T05:06:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"47ff210100a25eae2fbb80e3ea3052c175d033b262db2822be0a877e1759ff86","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-28T05:06:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/47ff210100a25eae2fbb80e3ea3052c175d033b262db2822be0a877e1759ff86"}
{"level":"debug","ts":"2026-07-28T05:06:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"47ff210100a25eae2fbb80e3ea3052c175d033b262db2822be0a877e1759ff86","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T05:06:34Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T05:06:34Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["47ff210100a25eae2fbb80e3ea3052c175d033b262db2822be0a877e1759ff86"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T05:06:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"47ff210100a25eae2fbb80e3ea3052c175d033b262db2822be0a877e1759ff86","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T05:06:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"47ff210100a25eae2fbb80e3ea3052c175d033b262db2822be0a877e1759ff86","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-28T05:06:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/18519e445f8ddabb9bac24a9b959714898baa53b665e22a79f80b1a044699c78"}
{"level":"info","ts":"2026-07-28T05:06:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/47ff210100a25eae2fbb80e3ea3052c175d033b262db2822be0a877e1759ff86"}
{"level":"debug","ts":"2026-07-28T05:06:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"019c72e5a19fbd5e80c74103229755773ab3ff967f73d59418a96cebeb31e259","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T05:06:34Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T05:06:34Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T05:06:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"019c72e5a19fbd5e80c74103229755773ab3ff967f73d59418a96cebeb31e259","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T05:06:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"019c72e5a19fbd5e80c74103229755773ab3ff967f73d59418a96cebeb31e259","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T05:06:34Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T05:06:34Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T05:06:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/019c72e5a19fbd5e80c74103229755773ab3ff967f73d59418a96cebeb31e259"}
{"level":"info","ts":"2026-07-28T05:06:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"019c72e5a19fbd5e80c74103229755773ab3ff967f73d59418a96cebeb31e259","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T05:06:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ea0655c04c970c6e7ab0a4be396ca65ba43d4fae597a5c4175a4eec14ed988b9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T05:06:34Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T05:06:34Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T05:06:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ea0655c04c970c6e7ab0a4be396ca65ba43d4fae597a5c4175a4eec14ed988b9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T05:06:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"019c72e5a19fbd5e80c74103229755773ab3ff967f73d59418a96cebeb31e259","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T05:06:34Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T05:06:34Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["019c72e5a19fbd5e80c74103229755773ab3ff967f73d59418a96cebeb31e259"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T05:06:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ea0655c04c970c6e7ab0a4be396ca65ba43d4fae597a5c4175a4eec14ed988b9"}
{"level":"info","ts":"2026-07-28T05:06:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"019c72e5a19fbd5e80c74103229755773ab3ff967f73d59418a96cebeb31e259","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T05:06:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ea0655c04c970c6e7ab0a4be396ca65ba43d4fae597a5c4175a4eec14ed988b9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T05:06:34Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T05:06:34Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ea0655c04c970c6e7ab0a4be396ca65ba43d4fae597a5c4175a4eec14ed988b9"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T05:06:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ea0655c04c970c6e7ab0a4be396ca65ba43d4fae597a5c4175a4eec14ed988b9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T05:06:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"019c72e5a19fbd5e80c74103229755773ab3ff967f73d59418a96cebeb31e259","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T05:06:34Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T05:06:34Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T05:06:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/019c72e5a19fbd5e80c74103229755773ab3ff967f73d59418a96cebeb31e259"}
{"level":"info","ts":"2026-07-28T05:06:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"019c72e5a19fbd5e80c74103229755773ab3ff967f73d59418a96cebeb31e259","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T05:06:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ea0655c04c970c6e7ab0a4be396ca65ba43d4fae597a5c4175a4eec14ed988b9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T05:06:34Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T05:06:34Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T05:06:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ea0655c04c970c6e7ab0a4be396ca65ba43d4fae597a5c4175a4eec14ed988b9"}
{"level":"info","ts":"2026-07-28T05:06:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ea0655c04c970c6e7ab0a4be396ca65ba43d4fae597a5c4175a4eec14ed988b9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T05:06:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"019c72e5a19fbd5e80c74103229755773ab3ff967f73d59418a96cebeb31e259","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T05:06:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ea0655c04c970c6e7ab0a4be396ca65ba43d4fae597a5c4175a4eec14ed988b9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T05:06:34Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T05:06:34Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ea0655c04c970c6e7ab0a4be396ca65ba43d4fae597a5c4175a4eec14ed988b9"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T05:06:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ea0655c04c970c6e7ab0a4be396ca65ba43d4fae597a5c4175a4eec14ed988b9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T05:06:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"019c72e5a19fbd5e80c74103229755773ab3ff967f73d59418a96cebeb31e259","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T05:06:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ea0655c04c970c6e7ab0a4be396ca65ba43d4fae597a5c4175a4eec14ed988b9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T05:06:34Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T05:06:34Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ea0655c04c970c6e7ab0a4be396ca65ba43d4fae597a5c4175a4eec14ed988b9"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-28T05:06:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"ea0655c04c970c6e7ab0a4be396ca65ba43d4fae597a5c4175a4eec14ed988b9","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"ea0655c04c970c6e7ab0a4be396ca65ba43d4fae597a5c4175a4eec14ed988b9\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-28T05:06:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ea0655c04c970c6e7ab0a4be396ca65ba43d4fae597a5c4175a4eec14ed988b9","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-28T05:06:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/019c72e5a19fbd5e80c74103229755773ab3ff967f73d59418a96cebeb31e259"}
{"level":"debug","ts":"2026-07-28T05:06:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ea0655c04c970c6e7ab0a4be396ca65ba43d4fae597a5c4175a4eec14ed988b9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T05:06:34Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T05:06:34Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T05:06:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ea0655c04c970c6e7ab0a4be396ca65ba43d4fae597a5c4175a4eec14ed988b9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T05:06:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"019c72e5a19fbd5e80c74103229755773ab3ff967f73d59418a96cebeb31e259","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T05:06:34Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T05:06:34Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["019c72e5a19fbd5e80c74103229755773ab3ff967f73d59418a96cebeb31e259"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T05:06:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ea0655c04c970c6e7ab0a4be396ca65ba43d4fae597a5c4175a4eec14ed988b9"}
{"level":"info","ts":"2026-07-28T05:06:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"019c72e5a19fbd5e80c74103229755773ab3ff967f73d59418a96cebeb31e259","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T05:06:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ea0655c04c970c6e7ab0a4be396ca65ba43d4fae597a5c4175a4eec14ed988b9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T05:06:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"019c72e5a19fbd5e80c74103229755773ab3ff967f73d59418a96cebeb31e259","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T05:06:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ea0655c04c970c6e7ab0a4be396ca65ba43d4fae597a5c4175a4eec14ed988b9","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-28T05:06:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ea0655c04c970c6e7ab0a4be396ca65ba43d4fae597a5c4175a4eec14ed988b9"}
{"level":"debug","ts":"2026-07-28T05:06:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ea0655c04c970c6e7ab0a4be396ca65ba43d4fae597a5c4175a4eec14ed988b9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T05:06:34Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T05:06:34Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ea0655c04c970c6e7ab0a4be396ca65ba43d4fae597a5c4175a4eec14ed988b9"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T05:06:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/019c72e5a19fbd5e80c74103229755773ab3ff967f73d59418a96cebeb31e259"}
{"level":"info","ts":"2026-07-28T05:06:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ea0655c04c970c6e7ab0a4be396ca65ba43d4fae597a5c4175a4eec14ed988b9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T05:06:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ea0655c04c970c6e7ab0a4be396ca65ba43d4fae597a5c4175a4eec14ed988b9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T05:06:34Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T05:06:34Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T05:06:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ea0655c04c970c6e7ab0a4be396ca65ba43d4fae597a5c4175a4eec14ed988b9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T05:06:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ea0655c04c970c6e7ab0a4be396ca65ba43d4fae597a5c4175a4eec14ed988b9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T05:06:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ea0655c04c970c6e7ab0a4be396ca65ba43d4fae597a5c4175a4eec14ed988b9","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-28T05:06:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ea0655c04c970c6e7ab0a4be396ca65ba43d4fae597a5c4175a4eec14ed988b9"}
{"level":"debug","ts":"2026-07-28T05:06:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ea0655c04c970c6e7ab0a4be396ca65ba43d4fae597a5c4175a4eec14ed988b9","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-28T05:06:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ea0655c04c970c6e7ab0a4be396ca65ba43d4fae597a5c4175a4eec14ed988b9"}
{"level":"debug","ts":"2026-07-28T05:06:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ea0655c04c970c6e7ab0a4be396ca65ba43d4fae597a5c4175a4eec14ed988b9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T05:06:34Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T05:06:34Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ea0655c04c970c6e7ab0a4be396ca65ba43d4fae597a5c4175a4eec14ed988b9"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T05:06:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ea0655c04c970c6e7ab0a4be396ca65ba43d4fae597a5c4175a4eec14ed988b9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T05:06:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ea0655c04c970c6e7ab0a4be396ca65ba43d4fae597a5c4175a4eec14ed988b9","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-28T05:06:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ea0655c04c970c6e7ab0a4be396ca65ba43d4fae597a5c4175a4eec14ed988b9"}
{"level":"info","ts":"2026-07-28T05:06:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3aa4addf-48b1-48e8-af90-5de0d6221036","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:40312","PortSpecifier":{"PortValue":40312}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.93:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3aa4addf-48b1-48e8-af90-5de0d6221036","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-ipp-a-dc1efb.apps.4b968787-e1ff-4996-be24-1047ba8bf1d6.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-28T05:06:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3aa4addf-48b1-48e8-af90-5de0d6221036","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:40312","PortSpecifier":{"PortValue":40312}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.93:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785215212,"nanos":365163601},"http":{"id":"3aa4addf-48b1-48e8-af90-5de0d6221036","method":"POST","headers":{":authority":"e2e-ipp-a-dc1efb.apps.4b968787-e1ff-4996-be24-1047ba8bf1d6.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T05:06:52Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"3aa4addf-48b1-48e8-af90-5de0d6221036","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-28T05:06:52Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3aa4addf-48b1-48e8-af90-5de0d6221036","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"a6220b9a-f932-4104-9d94-f7ddcf1fc828","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=36cff924-3b00-4199-a9fb-56d9bf87c328"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1047ba8bf1d6"]}}
{"level":"debug","ts":"2026-07-28T05:06:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3aa4addf-48b1-48e8-af90-5de0d6221036","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1047ba8bf1d6"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=36cff924-3b00-4199-a9fb-56d9bf87c328"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"a6220b9a-f932-4104-9d94-f7ddcf1fc828","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"d6bcc45c7b1f4b87a0e7a36c92b9fd27e92a3d08251b86c64b656eac9aff72ca"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.93:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-ipp-a-dc1efb.apps.4b968787-e1ff-4996-be24-1047ba8bf1d6.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T05:06:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3aa4addf-48b1-48e8-af90-5de0d6221036","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T05:06:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3aa4addf-48b1-48e8-af90-5de0d6221036","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T05:06:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3aa4addf-48b1-48e8-af90-5de0d6221036","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-ipp-a-dc1efb/ipp-route-dc1efb\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-ipp-a-dc1efb/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T05:06:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"3aa4addf-48b1-48e8-af90-5de0d6221036","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-28T05:06:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3aa4addf-48b1-48e8-af90-5de0d6221036","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-28T05:06:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3aa4addf-48b1-48e8-af90-5de0d6221036","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-28T05:06:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3aa4addf-48b1-48e8-af90-5de0d6221036","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-28T05:06:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3aa4addf-48b1-48e8-af90-5de0d6221036","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-28T05:06:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cd74cd63-b10a-4331-b231-f112f532c023","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:40324","PortSpecifier":{"PortValue":40324}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.93:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"cd74cd63-b10a-4331-b231-f112f532c023","method":"POST","path":"/ai-tenant-e2e-ipp-a-dc1efb/ipp-route-dc1efb/v1/chat/completions","host":"e2e-ipp-a-dc1efb.apps.4b968787-e1ff-4996-be24-1047ba8bf1d6.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-28T05:06:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cd74cd63-b10a-4331-b231-f112f532c023","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:40324","PortSpecifier":{"PortValue":40324}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.93:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785215214,"nanos":429191538},"http":{"id":"cd74cd63-b10a-4331-b231-f112f532c023","method":"POST","headers":{":authority":"e2e-ipp-a-dc1efb.apps.4b968787-e1ff-4996-be24-1047ba8bf1d6.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-ipp-a-dc1efb/ipp-route-dc1efb/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T05:06:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"cd74cd63-b10a-4331-b231-f112f532c023","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1C7pwhLJWoTPOTUN6_4lVdknPrqSy9cejjNZyG1iTPq5JBIeNtdoVFBEGkgsF"}
{"level":"debug","ts":"2026-07-28T05:06:54Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"cd74cd63-b10a-4331-b231-f112f532c023","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-ipp-a-dc1efb.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1C7pwhLJWoTPOTUN6_4lVdknPrqSy9cejjNZyG1iTPq5JBIeNtdoVFBEGkgsF\"}"}
{"level":"debug","ts":"2026-07-28T05:06:54Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"cd74cd63-b10a-4331-b231-f112f532c023","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-ipp-a-dc1efb.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"872a7e6c-0030-430f-b610-88df78762725","keyName":"e2e-ipp-dc1efb","subscription":"ipp-route-dc1efb-sub","tenant":"e2e-ipp-a-dc1efb","userId":"872a7e6c-0030-430f-b610-88df78762725","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-28T05:06:54Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"cd74cd63-b10a-4331-b231-f112f532c023","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-ipp-a-dc1efb.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-ipp-a-dc1efb/ipp-route-dc1efb\",\"requestedSubscription\":\"ipp-route-dc1efb-sub\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-28T05:06:54Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"cd74cd63-b10a-4331-b231-f112f532c023","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-ipp-a-dc1efb.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-ipp-a-dc1efb/models/facebook/opt-125m","name":"ipp-route-dc1efb","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"ipp-route-dc1efb-sub","namespace":"ai-tenant-e2e-ipp-a-dc1efb","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-ipp-a-dc1efb/ipp-route-dc1efb"}}
{"level":"debug","ts":"2026-07-28T05:06:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"cd74cd63-b10a-4331-b231-f112f532c023","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T05:06:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cd74cd63-b10a-4331-b231-f112f532c023","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T05:06:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cd74cd63-b10a-4331-b231-f112f532c023","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T05:06:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cd74cd63-b10a-4331-b231-f112f532c023","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-ipp-a-dc1efb/ipp-route-dc1efb\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-ipp-a-dc1efb/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T05:06:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cd74cd63-b10a-4331-b231-f112f532c023","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T05:06:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cd74cd63-b10a-4331-b231-f112f532c023","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-28T05:06:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cd74cd63-b10a-4331-b231-f112f532c023","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"ipp-route-dc1efb-sub"}
{"level":"debug","ts":"2026-07-28T05:06:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cd74cd63-b10a-4331-b231-f112f532c023","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-28T05:06:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cd74cd63-b10a-4331-b231-f112f532c023","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"872a7e6c-0030-430f-b610-88df78762725","keyName":"e2e-ipp-dc1efb","selected_subscription":"ipp-route-dc1efb-sub","selected_subscription_key":"ai-tenant-e2e-ipp-a-dc1efb/ipp-route-dc1efb-sub@ai-tenant-e2e-ipp-a-dc1efb/ipp-route-dc1efb","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-ipp-a-dc1efb/models/facebook/opt-125m","name":"ipp-route-dc1efb","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"ipp-route-dc1efb-sub","namespace":"ai-tenant-e2e-ipp-a-dc1efb","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-ipp-a-dc1efb/ipp-route-dc1efb"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-28T05:06:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cd74cd63-b10a-4331-b231-f112f532c023","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-28T05:06:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cd74cd63-b10a-4331-b231-f112f532c023","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-28T05:07:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f4f105677adb6d24d95b24eb8ac4221664ffa268c9db7660b1afdbb881f262c5"}
{"level":"info","ts":"2026-07-28T05:07:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/941d0249afb4adb352185deca07a0a1b7060fe727112c271fe3493bafdade285"}
{"level":"info","ts":"2026-07-28T05:07:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ea0655c04c970c6e7ab0a4be396ca65ba43d4fae597a5c4175a4eec14ed988b9"}
{"level":"info","ts":"2026-07-28T05:07:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/019c72e5a19fbd5e80c74103229755773ab3ff967f73d59418a96cebeb31e259"}
{"level":"info","ts":"2026-07-28T05:07:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/cc05fdafad3dc7b24d485590d4a2b8ea838f050122d0e5a267a4835068dd3ef2"}
{"level":"info","ts":"2026-07-28T05:07:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/18519e445f8ddabb9bac24a9b959714898baa53b665e22a79f80b1a044699c78"}
{"level":"info","ts":"2026-07-28T05:07:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/608ce3f20a3b67084b126ac5ac0847da296f174174e92f39318d1990bc1096ae"}
{"level":"info","ts":"2026-07-28T05:07:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d6bcc45c7b1f4b87a0e7a36c92b9fd27e92a3d08251b86c64b656eac9aff72ca"}
{"level":"info","ts":"2026-07-28T05:07:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/47ff210100a25eae2fbb80e3ea3052c175d033b262db2822be0a877e1759ff86"}
{"level":"info","ts":"2026-07-28T05:07:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/55e4fda286cd2427522f272d9e4b13d0380bac860e3a2f0afe4effd546f635f6"}
{"level":"info","ts":"2026-07-28T05:07:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c29f98beaf784330acdcd8a8d5e5786fb9804f6d99127b7d705a0058fd724160"}
{"level":"info","ts":"2026-07-28T05:07:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a0b3be065eb20c0fbcb2f77a15d4b18c323a342bc1f5fb515fdc31ff93c0f438"}