{"level":"info","ts":"2026-07-06T20:05:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6e38df8dbfc86f0cfd7668c8dbbba60997a349a939a17f932f441a384886871c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:05:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c290fd37072c2652a738930d66454761d0ad2c881fd01b4555d88cd653b258bf","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T20:05:20Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T20:05:20Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c290fd37072c2652a738930d66454761d0ad2c881fd01b4555d88cd653b258bf"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T20:05:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c290fd37072c2652a738930d66454761d0ad2c881fd01b4555d88cd653b258bf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:05:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6e38df8dbfc86f0cfd7668c8dbbba60997a349a939a17f932f441a384886871c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:05:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c290fd37072c2652a738930d66454761d0ad2c881fd01b4555d88cd653b258bf","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T20:05:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6e38df8dbfc86f0cfd7668c8dbbba60997a349a939a17f932f441a384886871c"}
{"level":"debug","ts":"2026-07-06T20:05:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6e38df8dbfc86f0cfd7668c8dbbba60997a349a939a17f932f441a384886871c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T20:05:20Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T20:05:20Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["6e38df8dbfc86f0cfd7668c8dbbba60997a349a939a17f932f441a384886871c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T20:05:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c290fd37072c2652a738930d66454761d0ad2c881fd01b4555d88cd653b258bf"}
{"level":"info","ts":"2026-07-06T20:05:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6e38df8dbfc86f0cfd7668c8dbbba60997a349a939a17f932f441a384886871c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:05:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6e38df8dbfc86f0cfd7668c8dbbba60997a349a939a17f932f441a384886871c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T20:05:20Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T20:05:20Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T20:05:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6e38df8dbfc86f0cfd7668c8dbbba60997a349a939a17f932f441a384886871c"}
{"level":"info","ts":"2026-07-06T20:05:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6e38df8dbfc86f0cfd7668c8dbbba60997a349a939a17f932f441a384886871c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:05:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6e38df8dbfc86f0cfd7668c8dbbba60997a349a939a17f932f441a384886871c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T20:05:20Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T20:05:20Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["6e38df8dbfc86f0cfd7668c8dbbba60997a349a939a17f932f441a384886871c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T20:05:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6e38df8dbfc86f0cfd7668c8dbbba60997a349a939a17f932f441a384886871c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:05:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6e38df8dbfc86f0cfd7668c8dbbba60997a349a939a17f932f441a384886871c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:05:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6e38df8dbfc86f0cfd7668c8dbbba60997a349a939a17f932f441a384886871c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T20:05:20Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T20:05:20Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T20:05:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6e38df8dbfc86f0cfd7668c8dbbba60997a349a939a17f932f441a384886871c"}
{"level":"info","ts":"2026-07-06T20:05:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6e38df8dbfc86f0cfd7668c8dbbba60997a349a939a17f932f441a384886871c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:05:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6e38df8dbfc86f0cfd7668c8dbbba60997a349a939a17f932f441a384886871c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T20:05:20Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T20:05:20Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T20:05:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6e38df8dbfc86f0cfd7668c8dbbba60997a349a939a17f932f441a384886871c"}
{"level":"error","ts":"2026-07-06T20:05:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"6e38df8dbfc86f0cfd7668c8dbbba60997a349a939a17f932f441a384886871c","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"6e38df8dbfc86f0cfd7668c8dbbba60997a349a939a17f932f441a384886871c\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-06T20:05:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6e38df8dbfc86f0cfd7668c8dbbba60997a349a939a17f932f441a384886871c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T20:05:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6e38df8dbfc86f0cfd7668c8dbbba60997a349a939a17f932f441a384886871c"}
{"level":"debug","ts":"2026-07-06T20:05:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6e38df8dbfc86f0cfd7668c8dbbba60997a349a939a17f932f441a384886871c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T20:05:20Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T20:05:20Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["6e38df8dbfc86f0cfd7668c8dbbba60997a349a939a17f932f441a384886871c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T20:05:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6e38df8dbfc86f0cfd7668c8dbbba60997a349a939a17f932f441a384886871c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:05:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6e38df8dbfc86f0cfd7668c8dbbba60997a349a939a17f932f441a384886871c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T20:05:20Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T20:05:20Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T20:05:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6e38df8dbfc86f0cfd7668c8dbbba60997a349a939a17f932f441a384886871c"}
{"level":"info","ts":"2026-07-06T20:05:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6e38df8dbfc86f0cfd7668c8dbbba60997a349a939a17f932f441a384886871c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:05:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6e38df8dbfc86f0cfd7668c8dbbba60997a349a939a17f932f441a384886871c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T20:05:20Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T20:05:20Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["6e38df8dbfc86f0cfd7668c8dbbba60997a349a939a17f932f441a384886871c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T20:05:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6e38df8dbfc86f0cfd7668c8dbbba60997a349a939a17f932f441a384886871c"}
{"level":"info","ts":"2026-07-06T20:05:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6e38df8dbfc86f0cfd7668c8dbbba60997a349a939a17f932f441a384886871c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:05:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6e38df8dbfc86f0cfd7668c8dbbba60997a349a939a17f932f441a384886871c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T20:05:20Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T20:05:20Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["6e38df8dbfc86f0cfd7668c8dbbba60997a349a939a17f932f441a384886871c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-06T20:05:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"6e38df8dbfc86f0cfd7668c8dbbba60997a349a939a17f932f441a384886871c","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"6e38df8dbfc86f0cfd7668c8dbbba60997a349a939a17f932f441a384886871c\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-06T20:05:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"81ab0c4c6095e5c311389af030cede5fc3b12956d6dc6ac00577314d30947009","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T20:05:20Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T20:05:20Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T20:05:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6e38df8dbfc86f0cfd7668c8dbbba60997a349a939a17f932f441a384886871c"}
{"level":"info","ts":"2026-07-06T20:05:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"81ab0c4c6095e5c311389af030cede5fc3b12956d6dc6ac00577314d30947009","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:05:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6e38df8dbfc86f0cfd7668c8dbbba60997a349a939a17f932f441a384886871c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:05:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"81ab0c4c6095e5c311389af030cede5fc3b12956d6dc6ac00577314d30947009","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T20:05:20Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T20:05:20Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T20:05:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/81ab0c4c6095e5c311389af030cede5fc3b12956d6dc6ac00577314d30947009"}
{"level":"info","ts":"2026-07-06T20:05:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/81ab0c4c6095e5c311389af030cede5fc3b12956d6dc6ac00577314d30947009"}
{"level":"info","ts":"2026-07-06T20:05:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"81ab0c4c6095e5c311389af030cede5fc3b12956d6dc6ac00577314d30947009","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:05:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"81ab0c4c6095e5c311389af030cede5fc3b12956d6dc6ac00577314d30947009","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T20:05:20Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T20:05:20Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["81ab0c4c6095e5c311389af030cede5fc3b12956d6dc6ac00577314d30947009"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-06T20:05:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"81ab0c4c6095e5c311389af030cede5fc3b12956d6dc6ac00577314d30947009","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"81ab0c4c6095e5c311389af030cede5fc3b12956d6dc6ac00577314d30947009\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-06T20:05:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"81ab0c4c6095e5c311389af030cede5fc3b12956d6dc6ac00577314d30947009","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:05:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"81ab0c4c6095e5c311389af030cede5fc3b12956d6dc6ac00577314d30947009","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T20:05:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/81ab0c4c6095e5c311389af030cede5fc3b12956d6dc6ac00577314d30947009"}
{"level":"debug","ts":"2026-07-06T20:05:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"be10f31b29274d7fc7a2ff52919f84b0471fef38f86e2848b8f4968ec9e035c8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T20:05:20Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T20:05:20Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T20:05:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/be10f31b29274d7fc7a2ff52919f84b0471fef38f86e2848b8f4968ec9e035c8"}
{"level":"info","ts":"2026-07-06T20:05:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"be10f31b29274d7fc7a2ff52919f84b0471fef38f86e2848b8f4968ec9e035c8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:05:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"be10f31b29274d7fc7a2ff52919f84b0471fef38f86e2848b8f4968ec9e035c8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:05:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"be10f31b29274d7fc7a2ff52919f84b0471fef38f86e2848b8f4968ec9e035c8","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T20:05:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/be10f31b29274d7fc7a2ff52919f84b0471fef38f86e2848b8f4968ec9e035c8"}
{"level":"debug","ts":"2026-07-06T20:05:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"81ab0c4c6095e5c311389af030cede5fc3b12956d6dc6ac00577314d30947009","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T20:05:20Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T20:05:20Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["81ab0c4c6095e5c311389af030cede5fc3b12956d6dc6ac00577314d30947009"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T20:05:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"81ab0c4c6095e5c311389af030cede5fc3b12956d6dc6ac00577314d30947009","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:05:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"be10f31b29274d7fc7a2ff52919f84b0471fef38f86e2848b8f4968ec9e035c8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T20:05:20Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T20:05:20Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["be10f31b29274d7fc7a2ff52919f84b0471fef38f86e2848b8f4968ec9e035c8"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T20:05:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"be10f31b29274d7fc7a2ff52919f84b0471fef38f86e2848b8f4968ec9e035c8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:05:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"81ab0c4c6095e5c311389af030cede5fc3b12956d6dc6ac00577314d30947009","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T20:05:20Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T20:05:20Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T20:05:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/81ab0c4c6095e5c311389af030cede5fc3b12956d6dc6ac00577314d30947009"}
{"level":"info","ts":"2026-07-06T20:05:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"81ab0c4c6095e5c311389af030cede5fc3b12956d6dc6ac00577314d30947009","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:05:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"be10f31b29274d7fc7a2ff52919f84b0471fef38f86e2848b8f4968ec9e035c8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T20:05:20Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T20:05:20Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T20:05:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"be10f31b29274d7fc7a2ff52919f84b0471fef38f86e2848b8f4968ec9e035c8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:05:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"81ab0c4c6095e5c311389af030cede5fc3b12956d6dc6ac00577314d30947009","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T20:05:20Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T20:05:20Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["81ab0c4c6095e5c311389af030cede5fc3b12956d6dc6ac00577314d30947009"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T20:05:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"81ab0c4c6095e5c311389af030cede5fc3b12956d6dc6ac00577314d30947009","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:05:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"be10f31b29274d7fc7a2ff52919f84b0471fef38f86e2848b8f4968ec9e035c8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:05:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"81ab0c4c6095e5c311389af030cede5fc3b12956d6dc6ac00577314d30947009","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T20:05:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/be10f31b29274d7fc7a2ff52919f84b0471fef38f86e2848b8f4968ec9e035c8"}
{"level":"debug","ts":"2026-07-06T20:05:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"be10f31b29274d7fc7a2ff52919f84b0471fef38f86e2848b8f4968ec9e035c8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T20:05:20Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T20:05:20Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["be10f31b29274d7fc7a2ff52919f84b0471fef38f86e2848b8f4968ec9e035c8"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T20:05:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/81ab0c4c6095e5c311389af030cede5fc3b12956d6dc6ac00577314d30947009"}
{"level":"info","ts":"2026-07-06T20:05:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"be10f31b29274d7fc7a2ff52919f84b0471fef38f86e2848b8f4968ec9e035c8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:05:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"be10f31b29274d7fc7a2ff52919f84b0471fef38f86e2848b8f4968ec9e035c8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T20:05:20Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T20:05:20Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T20:05:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"be10f31b29274d7fc7a2ff52919f84b0471fef38f86e2848b8f4968ec9e035c8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:05:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f04bebfc01ac121bf2926f74fe62ccab94719519b552c0eda8b502d2fc40535e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T20:05:20Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T20:05:20Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T20:05:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/be10f31b29274d7fc7a2ff52919f84b0471fef38f86e2848b8f4968ec9e035c8"}
{"level":"info","ts":"2026-07-06T20:05:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f04bebfc01ac121bf2926f74fe62ccab94719519b552c0eda8b502d2fc40535e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:05:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"be10f31b29274d7fc7a2ff52919f84b0471fef38f86e2848b8f4968ec9e035c8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T20:05:20Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T20:05:20Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["be10f31b29274d7fc7a2ff52919f84b0471fef38f86e2848b8f4968ec9e035c8"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T20:05:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f04bebfc01ac121bf2926f74fe62ccab94719519b552c0eda8b502d2fc40535e"}
{"level":"info","ts":"2026-07-06T20:05:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"be10f31b29274d7fc7a2ff52919f84b0471fef38f86e2848b8f4968ec9e035c8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:05:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f04bebfc01ac121bf2926f74fe62ccab94719519b552c0eda8b502d2fc40535e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T20:05:20Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T20:05:20Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["f04bebfc01ac121bf2926f74fe62ccab94719519b552c0eda8b502d2fc40535e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T20:05:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/be10f31b29274d7fc7a2ff52919f84b0471fef38f86e2848b8f4968ec9e035c8"}
{"level":"info","ts":"2026-07-06T20:05:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f04bebfc01ac121bf2926f74fe62ccab94719519b552c0eda8b502d2fc40535e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:05:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"be10f31b29274d7fc7a2ff52919f84b0471fef38f86e2848b8f4968ec9e035c8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:05:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f04bebfc01ac121bf2926f74fe62ccab94719519b552c0eda8b502d2fc40535e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T20:05:20Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T20:05:20Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T20:05:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f04bebfc01ac121bf2926f74fe62ccab94719519b552c0eda8b502d2fc40535e"}
{"level":"info","ts":"2026-07-06T20:05:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/be10f31b29274d7fc7a2ff52919f84b0471fef38f86e2848b8f4968ec9e035c8"}
{"level":"info","ts":"2026-07-06T20:05:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f04bebfc01ac121bf2926f74fe62ccab94719519b552c0eda8b502d2fc40535e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:05:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f04bebfc01ac121bf2926f74fe62ccab94719519b552c0eda8b502d2fc40535e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:05:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f04bebfc01ac121bf2926f74fe62ccab94719519b552c0eda8b502d2fc40535e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:05:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ff910f55c001b36430840202a6446a61222ea7ad2935566f91b7f61559ff425b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T20:05:21Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T20:05:21Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T20:05:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f04bebfc01ac121bf2926f74fe62ccab94719519b552c0eda8b502d2fc40535e"}
{"level":"info","ts":"2026-07-06T20:05:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ff910f55c001b36430840202a6446a61222ea7ad2935566f91b7f61559ff425b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:05:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f04bebfc01ac121bf2926f74fe62ccab94719519b552c0eda8b502d2fc40535e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T20:05:21Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T20:05:21Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["f04bebfc01ac121bf2926f74fe62ccab94719519b552c0eda8b502d2fc40535e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T20:05:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ff910f55c001b36430840202a6446a61222ea7ad2935566f91b7f61559ff425b"}
{"level":"info","ts":"2026-07-06T20:05:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f04bebfc01ac121bf2926f74fe62ccab94719519b552c0eda8b502d2fc40535e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:05:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ff910f55c001b36430840202a6446a61222ea7ad2935566f91b7f61559ff425b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T20:05:21Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T20:05:21Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ff910f55c001b36430840202a6446a61222ea7ad2935566f91b7f61559ff425b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T20:05:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f04bebfc01ac121bf2926f74fe62ccab94719519b552c0eda8b502d2fc40535e"}
{"level":"info","ts":"2026-07-06T20:05:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ff910f55c001b36430840202a6446a61222ea7ad2935566f91b7f61559ff425b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:05:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f04bebfc01ac121bf2926f74fe62ccab94719519b552c0eda8b502d2fc40535e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:05:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ff910f55c001b36430840202a6446a61222ea7ad2935566f91b7f61559ff425b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T20:05:21Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T20:05:21Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T20:05:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ff910f55c001b36430840202a6446a61222ea7ad2935566f91b7f61559ff425b"}
{"level":"info","ts":"2026-07-06T20:05:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ff910f55c001b36430840202a6446a61222ea7ad2935566f91b7f61559ff425b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:05:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ff910f55c001b36430840202a6446a61222ea7ad2935566f91b7f61559ff425b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T20:05:21Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T20:05:21Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ff910f55c001b36430840202a6446a61222ea7ad2935566f91b7f61559ff425b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T20:05:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f04bebfc01ac121bf2926f74fe62ccab94719519b552c0eda8b502d2fc40535e"}
{"level":"info","ts":"2026-07-06T20:05:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ff910f55c001b36430840202a6446a61222ea7ad2935566f91b7f61559ff425b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:05:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ff910f55c001b36430840202a6446a61222ea7ad2935566f91b7f61559ff425b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:05:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ff910f55c001b36430840202a6446a61222ea7ad2935566f91b7f61559ff425b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T20:05:21Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T20:05:21Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T20:05:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ff910f55c001b36430840202a6446a61222ea7ad2935566f91b7f61559ff425b"}
{"level":"info","ts":"2026-07-06T20:05:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ff910f55c001b36430840202a6446a61222ea7ad2935566f91b7f61559ff425b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:05:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ff910f55c001b36430840202a6446a61222ea7ad2935566f91b7f61559ff425b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T20:05:21Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T20:05:21Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-06T20:05:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"ff910f55c001b36430840202a6446a61222ea7ad2935566f91b7f61559ff425b","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"ff910f55c001b36430840202a6446a61222ea7ad2935566f91b7f61559ff425b\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-06T20:05:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ff910f55c001b36430840202a6446a61222ea7ad2935566f91b7f61559ff425b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:05:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ff910f55c001b36430840202a6446a61222ea7ad2935566f91b7f61559ff425b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T20:05:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ff910f55c001b36430840202a6446a61222ea7ad2935566f91b7f61559ff425b"}
{"level":"info","ts":"2026-07-06T20:05:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ff910f55c001b36430840202a6446a61222ea7ad2935566f91b7f61559ff425b"}
{"level":"debug","ts":"2026-07-06T20:05:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"557c9fa39cba552556d385df2ec1284ac39644dcf1a966f781da1d98866bc2e1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T20:05:21Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T20:05:21Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T20:05:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"557c9fa39cba552556d385df2ec1284ac39644dcf1a966f781da1d98866bc2e1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:05:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"557c9fa39cba552556d385df2ec1284ac39644dcf1a966f781da1d98866bc2e1","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T20:05:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/557c9fa39cba552556d385df2ec1284ac39644dcf1a966f781da1d98866bc2e1"}
{"level":"debug","ts":"2026-07-06T20:05:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"557c9fa39cba552556d385df2ec1284ac39644dcf1a966f781da1d98866bc2e1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:05:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ff910f55c001b36430840202a6446a61222ea7ad2935566f91b7f61559ff425b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T20:05:21Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T20:05:21Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ff910f55c001b36430840202a6446a61222ea7ad2935566f91b7f61559ff425b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T20:05:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/557c9fa39cba552556d385df2ec1284ac39644dcf1a966f781da1d98866bc2e1"}
{"level":"info","ts":"2026-07-06T20:05:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ff910f55c001b36430840202a6446a61222ea7ad2935566f91b7f61559ff425b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:05:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"557c9fa39cba552556d385df2ec1284ac39644dcf1a966f781da1d98866bc2e1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T20:05:21Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T20:05:21Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["557c9fa39cba552556d385df2ec1284ac39644dcf1a966f781da1d98866bc2e1"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T20:05:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ff910f55c001b36430840202a6446a61222ea7ad2935566f91b7f61559ff425b"}
{"level":"info","ts":"2026-07-06T20:05:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"557c9fa39cba552556d385df2ec1284ac39644dcf1a966f781da1d98866bc2e1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:05:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ff910f55c001b36430840202a6446a61222ea7ad2935566f91b7f61559ff425b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:05:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"557c9fa39cba552556d385df2ec1284ac39644dcf1a966f781da1d98866bc2e1","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T20:05:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/557c9fa39cba552556d385df2ec1284ac39644dcf1a966f781da1d98866bc2e1"}
{"level":"debug","ts":"2026-07-06T20:05:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6e38df8dbfc86f0cfd7668c8dbbba60997a349a939a17f932f441a384886871c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T20:05:46Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T20:05:46Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T20:05:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6e38df8dbfc86f0cfd7668c8dbbba60997a349a939a17f932f441a384886871c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:05:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6e38df8dbfc86f0cfd7668c8dbbba60997a349a939a17f932f441a384886871c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T20:05:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6e38df8dbfc86f0cfd7668c8dbbba60997a349a939a17f932f441a384886871c"}
{"level":"debug","ts":"2026-07-06T20:05:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6e38df8dbfc86f0cfd7668c8dbbba60997a349a939a17f932f441a384886871c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T20:05:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6e38df8dbfc86f0cfd7668c8dbbba60997a349a939a17f932f441a384886871c"}
{"level":"debug","ts":"2026-07-06T20:05:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6e38df8dbfc86f0cfd7668c8dbbba60997a349a939a17f932f441a384886871c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T20:05:46Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T20:05:46Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["6e38df8dbfc86f0cfd7668c8dbbba60997a349a939a17f932f441a384886871c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T20:05:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6e38df8dbfc86f0cfd7668c8dbbba60997a349a939a17f932f441a384886871c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:05:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6e38df8dbfc86f0cfd7668c8dbbba60997a349a939a17f932f441a384886871c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T20:05:46Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T20:05:46Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T20:05:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6e38df8dbfc86f0cfd7668c8dbbba60997a349a939a17f932f441a384886871c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:05:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6e38df8dbfc86f0cfd7668c8dbbba60997a349a939a17f932f441a384886871c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:05:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6e38df8dbfc86f0cfd7668c8dbbba60997a349a939a17f932f441a384886871c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T20:05:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6e38df8dbfc86f0cfd7668c8dbbba60997a349a939a17f932f441a384886871c"}
{"level":"debug","ts":"2026-07-06T20:05:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6e38df8dbfc86f0cfd7668c8dbbba60997a349a939a17f932f441a384886871c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T20:05:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6e38df8dbfc86f0cfd7668c8dbbba60997a349a939a17f932f441a384886871c"}
{"level":"debug","ts":"2026-07-06T20:05:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6e38df8dbfc86f0cfd7668c8dbbba60997a349a939a17f932f441a384886871c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T20:05:46Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T20:05:46Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["6e38df8dbfc86f0cfd7668c8dbbba60997a349a939a17f932f441a384886871c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T20:05:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6e38df8dbfc86f0cfd7668c8dbbba60997a349a939a17f932f441a384886871c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:05:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6e38df8dbfc86f0cfd7668c8dbbba60997a349a939a17f932f441a384886871c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T20:05:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6e38df8dbfc86f0cfd7668c8dbbba60997a349a939a17f932f441a384886871c"}
{"level":"debug","ts":"2026-07-06T20:05:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"aa8785305a08abe890ff7dda026ae9e6cebf659c57e7cbbd766e12c5e21bc37e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T20:05:46Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T20:05:46Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T20:05:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/aa8785305a08abe890ff7dda026ae9e6cebf659c57e7cbbd766e12c5e21bc37e"}
{"level":"info","ts":"2026-07-06T20:05:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"aa8785305a08abe890ff7dda026ae9e6cebf659c57e7cbbd766e12c5e21bc37e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:05:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"aa8785305a08abe890ff7dda026ae9e6cebf659c57e7cbbd766e12c5e21bc37e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:05:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"aa8785305a08abe890ff7dda026ae9e6cebf659c57e7cbbd766e12c5e21bc37e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T20:05:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/aa8785305a08abe890ff7dda026ae9e6cebf659c57e7cbbd766e12c5e21bc37e"}
{"level":"debug","ts":"2026-07-06T20:05:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"aa8785305a08abe890ff7dda026ae9e6cebf659c57e7cbbd766e12c5e21bc37e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T20:05:46Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T20:05:46Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["aa8785305a08abe890ff7dda026ae9e6cebf659c57e7cbbd766e12c5e21bc37e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T20:05:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"aa8785305a08abe890ff7dda026ae9e6cebf659c57e7cbbd766e12c5e21bc37e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:05:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"aa8785305a08abe890ff7dda026ae9e6cebf659c57e7cbbd766e12c5e21bc37e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T20:05:46Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T20:05:46Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T20:05:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"aa8785305a08abe890ff7dda026ae9e6cebf659c57e7cbbd766e12c5e21bc37e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:05:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"aa8785305a08abe890ff7dda026ae9e6cebf659c57e7cbbd766e12c5e21bc37e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T20:05:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/aa8785305a08abe890ff7dda026ae9e6cebf659c57e7cbbd766e12c5e21bc37e"}
{"level":"debug","ts":"2026-07-06T20:05:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"aa8785305a08abe890ff7dda026ae9e6cebf659c57e7cbbd766e12c5e21bc37e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T20:05:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/aa8785305a08abe890ff7dda026ae9e6cebf659c57e7cbbd766e12c5e21bc37e"}
{"level":"debug","ts":"2026-07-06T20:05:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"aa8785305a08abe890ff7dda026ae9e6cebf659c57e7cbbd766e12c5e21bc37e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T20:05:46Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T20:05:46Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["aa8785305a08abe890ff7dda026ae9e6cebf659c57e7cbbd766e12c5e21bc37e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T20:05:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"aa8785305a08abe890ff7dda026ae9e6cebf659c57e7cbbd766e12c5e21bc37e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:05:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"aa8785305a08abe890ff7dda026ae9e6cebf659c57e7cbbd766e12c5e21bc37e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T20:05:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/aa8785305a08abe890ff7dda026ae9e6cebf659c57e7cbbd766e12c5e21bc37e"}
{"level":"debug","ts":"2026-07-06T20:05:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"202e86462b4a9055ac07849a602d5adc57fa7f0b716c8fafc9d7f4606f5f7610","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T20:05:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/202e86462b4a9055ac07849a602d5adc57fa7f0b716c8fafc9d7f4606f5f7610"}
{"level":"debug","ts":"2026-07-06T20:05:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f04bebfc01ac121bf2926f74fe62ccab94719519b552c0eda8b502d2fc40535e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T20:05:47Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T20:05:47Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T20:05:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f04bebfc01ac121bf2926f74fe62ccab94719519b552c0eda8b502d2fc40535e"}
{"level":"info","ts":"2026-07-06T20:05:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f04bebfc01ac121bf2926f74fe62ccab94719519b552c0eda8b502d2fc40535e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:05:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f04bebfc01ac121bf2926f74fe62ccab94719519b552c0eda8b502d2fc40535e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:05:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f04bebfc01ac121bf2926f74fe62ccab94719519b552c0eda8b502d2fc40535e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T20:05:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f04bebfc01ac121bf2926f74fe62ccab94719519b552c0eda8b502d2fc40535e"}
{"level":"debug","ts":"2026-07-06T20:05:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f04bebfc01ac121bf2926f74fe62ccab94719519b552c0eda8b502d2fc40535e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T20:05:47Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T20:05:47Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["f04bebfc01ac121bf2926f74fe62ccab94719519b552c0eda8b502d2fc40535e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T20:05:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f04bebfc01ac121bf2926f74fe62ccab94719519b552c0eda8b502d2fc40535e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:05:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f04bebfc01ac121bf2926f74fe62ccab94719519b552c0eda8b502d2fc40535e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T20:05:47Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T20:05:47Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T20:05:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f04bebfc01ac121bf2926f74fe62ccab94719519b552c0eda8b502d2fc40535e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:05:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f04bebfc01ac121bf2926f74fe62ccab94719519b552c0eda8b502d2fc40535e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T20:05:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f04bebfc01ac121bf2926f74fe62ccab94719519b552c0eda8b502d2fc40535e"}
{"level":"debug","ts":"2026-07-06T20:05:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f04bebfc01ac121bf2926f74fe62ccab94719519b552c0eda8b502d2fc40535e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:05:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"40e3d5353e8d81831797688a39423707c6bf92a8999fa3557bb5c03dd7161fa0","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T20:05:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f04bebfc01ac121bf2926f74fe62ccab94719519b552c0eda8b502d2fc40535e"}
{"level":"debug","ts":"2026-07-06T20:05:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f04bebfc01ac121bf2926f74fe62ccab94719519b552c0eda8b502d2fc40535e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T20:05:47Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T20:05:47Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["f04bebfc01ac121bf2926f74fe62ccab94719519b552c0eda8b502d2fc40535e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T20:05:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/40e3d5353e8d81831797688a39423707c6bf92a8999fa3557bb5c03dd7161fa0"}
{"level":"info","ts":"2026-07-06T20:05:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f04bebfc01ac121bf2926f74fe62ccab94719519b552c0eda8b502d2fc40535e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:05:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f04bebfc01ac121bf2926f74fe62ccab94719519b552c0eda8b502d2fc40535e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T20:05:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f04bebfc01ac121bf2926f74fe62ccab94719519b552c0eda8b502d2fc40535e"}
{"level":"debug","ts":"2026-07-06T20:05:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6fff1d9d9ed10c87624eb7f0a63c02edef9402e389de41761d0f22d81ec4e3a4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T20:05:47Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T20:05:47Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T20:05:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6fff1d9d9ed10c87624eb7f0a63c02edef9402e389de41761d0f22d81ec4e3a4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:05:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6fff1d9d9ed10c87624eb7f0a63c02edef9402e389de41761d0f22d81ec4e3a4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T20:05:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6fff1d9d9ed10c87624eb7f0a63c02edef9402e389de41761d0f22d81ec4e3a4"}
{"level":"debug","ts":"2026-07-06T20:05:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6fff1d9d9ed10c87624eb7f0a63c02edef9402e389de41761d0f22d81ec4e3a4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T20:05:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6fff1d9d9ed10c87624eb7f0a63c02edef9402e389de41761d0f22d81ec4e3a4"}
{"level":"debug","ts":"2026-07-06T20:05:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6fff1d9d9ed10c87624eb7f0a63c02edef9402e389de41761d0f22d81ec4e3a4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T20:05:47Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T20:05:47Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["6fff1d9d9ed10c87624eb7f0a63c02edef9402e389de41761d0f22d81ec4e3a4"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T20:05:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6fff1d9d9ed10c87624eb7f0a63c02edef9402e389de41761d0f22d81ec4e3a4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:05:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6fff1d9d9ed10c87624eb7f0a63c02edef9402e389de41761d0f22d81ec4e3a4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:05:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"557c9fa39cba552556d385df2ec1284ac39644dcf1a966f781da1d98866bc2e1","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T20:05:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6fff1d9d9ed10c87624eb7f0a63c02edef9402e389de41761d0f22d81ec4e3a4"}
{"level":"debug","ts":"2026-07-06T20:05:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"81ab0c4c6095e5c311389af030cede5fc3b12956d6dc6ac00577314d30947009","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T20:05:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/557c9fa39cba552556d385df2ec1284ac39644dcf1a966f781da1d98866bc2e1"}
{"level":"info","ts":"2026-07-06T20:05:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/81ab0c4c6095e5c311389af030cede5fc3b12956d6dc6ac00577314d30947009"}
{"level":"debug","ts":"2026-07-06T20:05:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c290fd37072c2652a738930d66454761d0ad2c881fd01b4555d88cd653b258bf","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T20:05:47Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T20:05:47Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T20:05:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c290fd37072c2652a738930d66454761d0ad2c881fd01b4555d88cd653b258bf"}
{"level":"info","ts":"2026-07-06T20:05:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c290fd37072c2652a738930d66454761d0ad2c881fd01b4555d88cd653b258bf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:05:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c290fd37072c2652a738930d66454761d0ad2c881fd01b4555d88cd653b258bf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:05:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c290fd37072c2652a738930d66454761d0ad2c881fd01b4555d88cd653b258bf","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T20:05:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c290fd37072c2652a738930d66454761d0ad2c881fd01b4555d88cd653b258bf"}
{"level":"debug","ts":"2026-07-06T20:05:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c290fd37072c2652a738930d66454761d0ad2c881fd01b4555d88cd653b258bf","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T20:05:47Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T20:05:47Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c290fd37072c2652a738930d66454761d0ad2c881fd01b4555d88cd653b258bf"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T20:05:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c290fd37072c2652a738930d66454761d0ad2c881fd01b4555d88cd653b258bf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:05:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c290fd37072c2652a738930d66454761d0ad2c881fd01b4555d88cd653b258bf","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T20:05:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c290fd37072c2652a738930d66454761d0ad2c881fd01b4555d88cd653b258bf"}
{"level":"debug","ts":"2026-07-06T20:05:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"42974c8df0704b09e3878556fa0217110a9f2f94c1bf4eaa27ca80dbd2df4bfb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T20:05:47Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T20:05:47Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T20:05:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"42974c8df0704b09e3878556fa0217110a9f2f94c1bf4eaa27ca80dbd2df4bfb","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T20:05:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/42974c8df0704b09e3878556fa0217110a9f2f94c1bf4eaa27ca80dbd2df4bfb"}
{"level":"debug","ts":"2026-07-06T20:05:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"42974c8df0704b09e3878556fa0217110a9f2f94c1bf4eaa27ca80dbd2df4bfb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:05:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"44d5a1f2ebde73e06d9573326543ff88130f25e85bf3495a520eabb14c34750a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:05:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"42974c8df0704b09e3878556fa0217110a9f2f94c1bf4eaa27ca80dbd2df4bfb","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T20:05:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/42974c8df0704b09e3878556fa0217110a9f2f94c1bf4eaa27ca80dbd2df4bfb"}
{"level":"debug","ts":"2026-07-06T20:05:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"42974c8df0704b09e3878556fa0217110a9f2f94c1bf4eaa27ca80dbd2df4bfb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T20:05:47Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T20:05:47Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["42974c8df0704b09e3878556fa0217110a9f2f94c1bf4eaa27ca80dbd2df4bfb"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T20:05:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"42974c8df0704b09e3878556fa0217110a9f2f94c1bf4eaa27ca80dbd2df4bfb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:05:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"42974c8df0704b09e3878556fa0217110a9f2f94c1bf4eaa27ca80dbd2df4bfb","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T20:05:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/44d5a1f2ebde73e06d9573326543ff88130f25e85bf3495a520eabb14c34750a"}
{"level":"info","ts":"2026-07-06T20:05:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/42974c8df0704b09e3878556fa0217110a9f2f94c1bf4eaa27ca80dbd2df4bfb"}
{"level":"debug","ts":"2026-07-06T20:05:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"913da5197eeaedb037a0fccfed660b4abf390f6d82321ffebdcd045b5cddd00e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T20:05:47Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T20:05:47Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T20:05:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"913da5197eeaedb037a0fccfed660b4abf390f6d82321ffebdcd045b5cddd00e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:05:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"913da5197eeaedb037a0fccfed660b4abf390f6d82321ffebdcd045b5cddd00e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T20:05:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/913da5197eeaedb037a0fccfed660b4abf390f6d82321ffebdcd045b5cddd00e"}
{"level":"debug","ts":"2026-07-06T20:05:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"913da5197eeaedb037a0fccfed660b4abf390f6d82321ffebdcd045b5cddd00e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:05:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"10ab7997502692fb8bfa82ad74bbb1773ee0111d4792eb020da3fc74ec8fcce6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:05:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ff910f55c001b36430840202a6446a61222ea7ad2935566f91b7f61559ff425b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T20:05:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/913da5197eeaedb037a0fccfed660b4abf390f6d82321ffebdcd045b5cddd00e"}
{"level":"debug","ts":"2026-07-06T20:05:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"913da5197eeaedb037a0fccfed660b4abf390f6d82321ffebdcd045b5cddd00e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T20:05:48Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T20:05:48Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["913da5197eeaedb037a0fccfed660b4abf390f6d82321ffebdcd045b5cddd00e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T20:05:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"913da5197eeaedb037a0fccfed660b4abf390f6d82321ffebdcd045b5cddd00e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:05:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"913da5197eeaedb037a0fccfed660b4abf390f6d82321ffebdcd045b5cddd00e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T20:05:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/10ab7997502692fb8bfa82ad74bbb1773ee0111d4792eb020da3fc74ec8fcce6"}
{"level":"debug","ts":"2026-07-06T20:05:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"587b77012c9a8af1e9972a639b5c14b5be92391d71cd7aa625674d0b445047ae","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T20:05:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ff910f55c001b36430840202a6446a61222ea7ad2935566f91b7f61559ff425b"}
{"level":"debug","ts":"2026-07-06T20:05:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e3da8387e57c914b6d984a3f13179a926ed680f8655fdfa9eda72393f5810c10","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T20:05:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/913da5197eeaedb037a0fccfed660b4abf390f6d82321ffebdcd045b5cddd00e"}
{"level":"debug","ts":"2026-07-06T20:05:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9a286657a61605a6c4db687cecdec77fb08d52d653428a8ecc52e94838d856af","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T20:05:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/587b77012c9a8af1e9972a639b5c14b5be92391d71cd7aa625674d0b445047ae"}
{"level":"debug","ts":"2026-07-06T20:05:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"be10f31b29274d7fc7a2ff52919f84b0471fef38f86e2848b8f4968ec9e035c8","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T20:05:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e3da8387e57c914b6d984a3f13179a926ed680f8655fdfa9eda72393f5810c10"}
{"level":"debug","ts":"2026-07-06T20:05:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4dd2f6ada48b63f6212a40fd8e7be79f33eeac2b4dc6b670c3c2d96a5eba0424","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T20:05:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9a286657a61605a6c4db687cecdec77fb08d52d653428a8ecc52e94838d856af"}
{"level":"debug","ts":"2026-07-06T20:05:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e88012a6e19d0849a8e05ff6b538c3c5f2350430b3110fd6458061dbc61430cd","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T20:05:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/be10f31b29274d7fc7a2ff52919f84b0471fef38f86e2848b8f4968ec9e035c8"}
{"level":"info","ts":"2026-07-06T20:05:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4dd2f6ada48b63f6212a40fd8e7be79f33eeac2b4dc6b670c3c2d96a5eba0424"}
{"level":"info","ts":"2026-07-06T20:05:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e88012a6e19d0849a8e05ff6b538c3c5f2350430b3110fd6458061dbc61430cd"}
{"level":"info","ts":"2026-07-06T20:05:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4c8ea62f-794a-4b84-914e-83850d99c3d4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:33778","PortSpecifier":{"PortValue":33778}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.41:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"4c8ea62f-794a-4b84-914e-83850d99c3d4","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-e1f716.apps.0ddafa3d-b0a0-4bcd-9d42-60474a7ad191.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T20:05:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4c8ea62f-794a-4b84-914e-83850d99c3d4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:33778","PortSpecifier":{"PortValue":33778}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.41:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783368351,"nanos":47040277},"http":{"id":"4c8ea62f-794a-4b84-914e-83850d99c3d4","method":"POST","headers":{":authority":"e2e-shared-a-e1f716.apps.0ddafa3d-b0a0-4bcd-9d42-60474a7ad191.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T20:05:51Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"4c8ea62f-794a-4b84-914e-83850d99c3d4","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-06T20:05:51Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"4c8ea62f-794a-4b84-914e-83850d99c3d4","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"a5d356b1-3180-412a-8dea-76750349e251","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=57fd0aa1-6d66-4aee-9de0-7b7661d60c4b"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/60474a7ad191"]}}
{"level":"debug","ts":"2026-07-06T20:05:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"4c8ea62f-794a-4b84-914e-83850d99c3d4","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/60474a7ad191"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=57fd0aa1-6d66-4aee-9de0-7b7661d60c4b"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"a5d356b1-3180-412a-8dea-76750349e251","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"aa8785305a08abe890ff7dda026ae9e6cebf659c57e7cbbd766e12c5e21bc37e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.41:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-e1f716.apps.0ddafa3d-b0a0-4bcd-9d42-60474a7ad191.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T20:05:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4c8ea62f-794a-4b84-914e-83850d99c3d4","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:05:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4c8ea62f-794a-4b84-914e-83850d99c3d4","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:05:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4c8ea62f-794a-4b84-914e-83850d99c3d4","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e1f716/rate-test-model-e1f716\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:05:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"4c8ea62f-794a-4b84-914e-83850d99c3d4","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-06T20:05:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4c8ea62f-794a-4b84-914e-83850d99c3d4","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T20:05:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4c8ea62f-794a-4b84-914e-83850d99c3d4","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-06T20:05:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4c8ea62f-794a-4b84-914e-83850d99c3d4","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T20:05:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4c8ea62f-794a-4b84-914e-83850d99c3d4","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T20:05:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"28ed0804-54b4-4a06-960d-a67bb80b278e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:58922","PortSpecifier":{"PortValue":58922}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.42:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"28ed0804-54b4-4a06-960d-a67bb80b278e","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-035267.apps.0ddafa3d-b0a0-4bcd-9d42-60474a7ad191.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T20:05:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"28ed0804-54b4-4a06-960d-a67bb80b278e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:58922","PortSpecifier":{"PortValue":58922}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.42:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783368351,"nanos":88311283},"http":{"id":"28ed0804-54b4-4a06-960d-a67bb80b278e","method":"POST","headers":{":authority":"e2e-shared-b-035267.apps.0ddafa3d-b0a0-4bcd-9d42-60474a7ad191.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T20:05:51Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"28ed0804-54b4-4a06-960d-a67bb80b278e","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-06T20:05:51Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"28ed0804-54b4-4a06-960d-a67bb80b278e","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"a5d356b1-3180-412a-8dea-76750349e251","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=57fd0aa1-6d66-4aee-9de0-7b7661d60c4b"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/60474a7ad191"]}}
{"level":"debug","ts":"2026-07-06T20:05:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"28ed0804-54b4-4a06-960d-a67bb80b278e","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/60474a7ad191"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=57fd0aa1-6d66-4aee-9de0-7b7661d60c4b"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"a5d356b1-3180-412a-8dea-76750349e251","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"40e3d5353e8d81831797688a39423707c6bf92a8999fa3557bb5c03dd7161fa0"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.42:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-035267.apps.0ddafa3d-b0a0-4bcd-9d42-60474a7ad191.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T20:05:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"28ed0804-54b4-4a06-960d-a67bb80b278e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:05:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"28ed0804-54b4-4a06-960d-a67bb80b278e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:05:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"28ed0804-54b4-4a06-960d-a67bb80b278e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-035267/rate-test-model-035267\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:05:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"28ed0804-54b4-4a06-960d-a67bb80b278e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-06T20:05:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"28ed0804-54b4-4a06-960d-a67bb80b278e","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T20:05:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"28ed0804-54b4-4a06-960d-a67bb80b278e","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-06T20:05:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"28ed0804-54b4-4a06-960d-a67bb80b278e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T20:05:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"28ed0804-54b4-4a06-960d-a67bb80b278e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T20:05:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2215305e-d482-4f8f-9e08-310de7047b05","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:33784","PortSpecifier":{"PortValue":33784}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.41:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2215305e-d482-4f8f-9e08-310de7047b05","method":"POST","path":"/ai-tenant-e2e-shared-a-e1f716/rate-test-model-e1f716/v1/completions","host":"e2e-shared-a-e1f716.apps.0ddafa3d-b0a0-4bcd-9d42-60474a7ad191.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T20:05:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2215305e-d482-4f8f-9e08-310de7047b05","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:33784","PortSpecifier":{"PortValue":33784}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.41:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783368351,"nanos":130576408},"http":{"id":"2215305e-d482-4f8f-9e08-310de7047b05","method":"POST","headers":{":authority":"e2e-shared-a-e1f716.apps.0ddafa3d-b0a0-4bcd-9d42-60474a7ad191.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-e1f716/rate-test-model-e1f716/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T20:05:51Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2215305e-d482-4f8f-9e08-310de7047b05","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-j4YDVjjlYsDltxht_aixFyYnK7Tz9Gd2WpoDkjlVJWCIGnyjNb3uQjVgvwfN"}
{"level":"debug","ts":"2026-07-06T20:05:51Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2215305e-d482-4f8f-9e08-310de7047b05","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-e1f716.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-j4YDVjjlYsDltxht_aixFyYnK7Tz9Gd2WpoDkjlVJWCIGnyjNb3uQjVgvwfN\"}"}
{"level":"debug","ts":"2026-07-06T20:05:51Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2215305e-d482-4f8f-9e08-310de7047b05","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e1f716.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"667a7e4b-874c-477c-8e64-5bbf6e97d3d6","keyName":"e2e-rate-a-6fe24f","subscription":"e2e-rate-iso-a-6fe24f","tenant":"e2e-shared-a-e1f716","userId":"667a7e4b-874c-477c-8e64-5bbf6e97d3d6","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-06T20:05:51Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2215305e-d482-4f8f-9e08-310de7047b05","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-e1f716.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-e1f716/rate-test-model-e1f716\",\"requestedSubscription\":\"e2e-rate-iso-a-6fe24f\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-06T20:05:51Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2215305e-d482-4f8f-9e08-310de7047b05","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e1f716.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-e1f716","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6fe24f","namespace":"ai-tenant-e2e-shared-a-e1f716","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-06T20:05:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2215305e-d482-4f8f-9e08-310de7047b05","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T20:05:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2215305e-d482-4f8f-9e08-310de7047b05","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:05:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2215305e-d482-4f8f-9e08-310de7047b05","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:05:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2215305e-d482-4f8f-9e08-310de7047b05","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:05:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2215305e-d482-4f8f-9e08-310de7047b05","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e1f716/rate-test-model-e1f716\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:05:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2215305e-d482-4f8f-9e08-310de7047b05","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T20:05:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2215305e-d482-4f8f-9e08-310de7047b05","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-6fe24f"}
{"level":"debug","ts":"2026-07-06T20:05:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2215305e-d482-4f8f-9e08-310de7047b05","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T20:05:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2215305e-d482-4f8f-9e08-310de7047b05","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"667a7e4b-874c-477c-8e64-5bbf6e97d3d6","keyName":"e2e-rate-a-6fe24f","selected_subscription":"e2e-rate-iso-a-6fe24f","selected_subscription_key":"ai-tenant-e2e-shared-a-e1f716/e2e-rate-iso-a-6fe24f@ai-tenant-e2e-shared-a-e1f716/rate-test-model-e1f716","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-e1f716","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6fe24f","namespace":"ai-tenant-e2e-shared-a-e1f716","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-06T20:05:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2215305e-d482-4f8f-9e08-310de7047b05","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T20:05:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2215305e-d482-4f8f-9e08-310de7047b05","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T20:05:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0f066f8b-88b3-9db2-93ca-71fd2f7bd461","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:33786","PortSpecifier":{"PortValue":33786}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.41:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0f066f8b-88b3-9db2-93ca-71fd2f7bd461","method":"POST","path":"/ai-tenant-e2e-shared-a-e1f716/rate-test-model-e1f716/v1/completions","host":"e2e-shared-a-e1f716.apps.0ddafa3d-b0a0-4bcd-9d42-60474a7ad191.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T20:05:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0f066f8b-88b3-9db2-93ca-71fd2f7bd461","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:33786","PortSpecifier":{"PortValue":33786}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.41:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783368352,"nanos":189901111},"http":{"id":"0f066f8b-88b3-9db2-93ca-71fd2f7bd461","method":"POST","headers":{":authority":"e2e-shared-a-e1f716.apps.0ddafa3d-b0a0-4bcd-9d42-60474a7ad191.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-e1f716/rate-test-model-e1f716/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T20:05:52Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0f066f8b-88b3-9db2-93ca-71fd2f7bd461","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-j4YDVjjlYsDltxht_aixFyYnK7Tz9Gd2WpoDkjlVJWCIGnyjNb3uQjVgvwfN"}
{"level":"debug","ts":"2026-07-06T20:05:52Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0f066f8b-88b3-9db2-93ca-71fd2f7bd461","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-e1f716.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-j4YDVjjlYsDltxht_aixFyYnK7Tz9Gd2WpoDkjlVJWCIGnyjNb3uQjVgvwfN\"}"}
{"level":"debug","ts":"2026-07-06T20:05:52Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0f066f8b-88b3-9db2-93ca-71fd2f7bd461","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e1f716.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"667a7e4b-874c-477c-8e64-5bbf6e97d3d6","keyName":"e2e-rate-a-6fe24f","subscription":"e2e-rate-iso-a-6fe24f","tenant":"e2e-shared-a-e1f716","userId":"667a7e4b-874c-477c-8e64-5bbf6e97d3d6","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-06T20:05:52Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0f066f8b-88b3-9db2-93ca-71fd2f7bd461","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-e1f716.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-e1f716/rate-test-model-e1f716\",\"requestedSubscription\":\"e2e-rate-iso-a-6fe24f\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-06T20:05:52Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0f066f8b-88b3-9db2-93ca-71fd2f7bd461","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e1f716.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-e1f716","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6fe24f","namespace":"ai-tenant-e2e-shared-a-e1f716","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-06T20:05:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0f066f8b-88b3-9db2-93ca-71fd2f7bd461","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T20:05:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0f066f8b-88b3-9db2-93ca-71fd2f7bd461","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:05:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0f066f8b-88b3-9db2-93ca-71fd2f7bd461","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:05:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0f066f8b-88b3-9db2-93ca-71fd2f7bd461","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e1f716/rate-test-model-e1f716\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:05:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0f066f8b-88b3-9db2-93ca-71fd2f7bd461","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:05:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0f066f8b-88b3-9db2-93ca-71fd2f7bd461","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T20:05:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0f066f8b-88b3-9db2-93ca-71fd2f7bd461","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-6fe24f"}
{"level":"debug","ts":"2026-07-06T20:05:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0f066f8b-88b3-9db2-93ca-71fd2f7bd461","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T20:05:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0f066f8b-88b3-9db2-93ca-71fd2f7bd461","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"667a7e4b-874c-477c-8e64-5bbf6e97d3d6","keyName":"e2e-rate-a-6fe24f","selected_subscription":"e2e-rate-iso-a-6fe24f","selected_subscription_key":"ai-tenant-e2e-shared-a-e1f716/e2e-rate-iso-a-6fe24f@ai-tenant-e2e-shared-a-e1f716/rate-test-model-e1f716","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-e1f716","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6fe24f","namespace":"ai-tenant-e2e-shared-a-e1f716","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-06T20:05:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0f066f8b-88b3-9db2-93ca-71fd2f7bd461","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T20:05:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0f066f8b-88b3-9db2-93ca-71fd2f7bd461","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T20:05:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"83b271e5-39ed-4aa2-bf75-c092ad76c48d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:33798","PortSpecifier":{"PortValue":33798}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.41:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"83b271e5-39ed-4aa2-bf75-c092ad76c48d","method":"POST","path":"/ai-tenant-e2e-shared-a-e1f716/rate-test-model-e1f716/v1/completions","host":"e2e-shared-a-e1f716.apps.0ddafa3d-b0a0-4bcd-9d42-60474a7ad191.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T20:05:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"83b271e5-39ed-4aa2-bf75-c092ad76c48d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:33798","PortSpecifier":{"PortValue":33798}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.41:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783368353,"nanos":231069901},"http":{"id":"83b271e5-39ed-4aa2-bf75-c092ad76c48d","method":"POST","headers":{":authority":"e2e-shared-a-e1f716.apps.0ddafa3d-b0a0-4bcd-9d42-60474a7ad191.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-e1f716/rate-test-model-e1f716/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T20:05:53Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"83b271e5-39ed-4aa2-bf75-c092ad76c48d","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-j4YDVjjlYsDltxht_aixFyYnK7Tz9Gd2WpoDkjlVJWCIGnyjNb3uQjVgvwfN"}
{"level":"debug","ts":"2026-07-06T20:05:53Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"83b271e5-39ed-4aa2-bf75-c092ad76c48d","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-e1f716.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-j4YDVjjlYsDltxht_aixFyYnK7Tz9Gd2WpoDkjlVJWCIGnyjNb3uQjVgvwfN\"}"}
{"level":"debug","ts":"2026-07-06T20:05:53Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"83b271e5-39ed-4aa2-bf75-c092ad76c48d","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e1f716.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"667a7e4b-874c-477c-8e64-5bbf6e97d3d6","keyName":"e2e-rate-a-6fe24f","subscription":"e2e-rate-iso-a-6fe24f","tenant":"e2e-shared-a-e1f716","userId":"667a7e4b-874c-477c-8e64-5bbf6e97d3d6","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-06T20:05:53Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"83b271e5-39ed-4aa2-bf75-c092ad76c48d","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-e1f716.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-e1f716/rate-test-model-e1f716\",\"requestedSubscription\":\"e2e-rate-iso-a-6fe24f\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-06T20:05:53Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"83b271e5-39ed-4aa2-bf75-c092ad76c48d","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e1f716.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-e1f716","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6fe24f","namespace":"ai-tenant-e2e-shared-a-e1f716","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-06T20:05:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"83b271e5-39ed-4aa2-bf75-c092ad76c48d","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T20:05:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"83b271e5-39ed-4aa2-bf75-c092ad76c48d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:05:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"83b271e5-39ed-4aa2-bf75-c092ad76c48d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:05:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"83b271e5-39ed-4aa2-bf75-c092ad76c48d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e1f716/rate-test-model-e1f716\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:05:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"83b271e5-39ed-4aa2-bf75-c092ad76c48d","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:05:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"83b271e5-39ed-4aa2-bf75-c092ad76c48d","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T20:05:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"83b271e5-39ed-4aa2-bf75-c092ad76c48d","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T20:05:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"83b271e5-39ed-4aa2-bf75-c092ad76c48d","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-6fe24f"}
{"level":"debug","ts":"2026-07-06T20:05:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"83b271e5-39ed-4aa2-bf75-c092ad76c48d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"667a7e4b-874c-477c-8e64-5bbf6e97d3d6","keyName":"e2e-rate-a-6fe24f","selected_subscription":"e2e-rate-iso-a-6fe24f","selected_subscription_key":"ai-tenant-e2e-shared-a-e1f716/e2e-rate-iso-a-6fe24f@ai-tenant-e2e-shared-a-e1f716/rate-test-model-e1f716","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-e1f716","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6fe24f","namespace":"ai-tenant-e2e-shared-a-e1f716","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-06T20:05:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"83b271e5-39ed-4aa2-bf75-c092ad76c48d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T20:05:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"83b271e5-39ed-4aa2-bf75-c092ad76c48d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T20:06:11Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b78c39fc-1d63-4b1d-9b9e-8478ddf89b77","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:52006","PortSpecifier":{"PortValue":52006}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.41:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b78c39fc-1d63-4b1d-9b9e-8478ddf89b77","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-e1f716.apps.0ddafa3d-b0a0-4bcd-9d42-60474a7ad191.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T20:06:11Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b78c39fc-1d63-4b1d-9b9e-8478ddf89b77","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:52006","PortSpecifier":{"PortValue":52006}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.41:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783368371,"nanos":323311238},"http":{"id":"b78c39fc-1d63-4b1d-9b9e-8478ddf89b77","method":"POST","headers":{":authority":"e2e-shared-a-e1f716.apps.0ddafa3d-b0a0-4bcd-9d42-60474a7ad191.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T20:06:11Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"b78c39fc-1d63-4b1d-9b9e-8478ddf89b77","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-06T20:06:11Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b78c39fc-1d63-4b1d-9b9e-8478ddf89b77","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"a5d356b1-3180-412a-8dea-76750349e251","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=57fd0aa1-6d66-4aee-9de0-7b7661d60c4b"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/60474a7ad191"]}}
{"level":"debug","ts":"2026-07-06T20:06:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b78c39fc-1d63-4b1d-9b9e-8478ddf89b77","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/60474a7ad191"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=57fd0aa1-6d66-4aee-9de0-7b7661d60c4b"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"a5d356b1-3180-412a-8dea-76750349e251","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"aa8785305a08abe890ff7dda026ae9e6cebf659c57e7cbbd766e12c5e21bc37e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.41:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-e1f716.apps.0ddafa3d-b0a0-4bcd-9d42-60474a7ad191.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T20:06:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b78c39fc-1d63-4b1d-9b9e-8478ddf89b77","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:06:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b78c39fc-1d63-4b1d-9b9e-8478ddf89b77","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:06:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b78c39fc-1d63-4b1d-9b9e-8478ddf89b77","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e1f716/rate-test-model-e1f716\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:06:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"b78c39fc-1d63-4b1d-9b9e-8478ddf89b77","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-06T20:06:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b78c39fc-1d63-4b1d-9b9e-8478ddf89b77","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T20:06:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b78c39fc-1d63-4b1d-9b9e-8478ddf89b77","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-06T20:06:11Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b78c39fc-1d63-4b1d-9b9e-8478ddf89b77","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T20:06:11Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b78c39fc-1d63-4b1d-9b9e-8478ddf89b77","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T20:06:11Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"56bbc0f8-7701-4072-af4d-f5ac6a359c38","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:55524","PortSpecifier":{"PortValue":55524}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.42:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"56bbc0f8-7701-4072-af4d-f5ac6a359c38","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-035267.apps.0ddafa3d-b0a0-4bcd-9d42-60474a7ad191.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T20:06:11Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"56bbc0f8-7701-4072-af4d-f5ac6a359c38","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:55524","PortSpecifier":{"PortValue":55524}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.42:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783368371,"nanos":359171902},"http":{"id":"56bbc0f8-7701-4072-af4d-f5ac6a359c38","method":"POST","headers":{":authority":"e2e-shared-b-035267.apps.0ddafa3d-b0a0-4bcd-9d42-60474a7ad191.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T20:06:11Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"56bbc0f8-7701-4072-af4d-f5ac6a359c38","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-06T20:06:11Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"56bbc0f8-7701-4072-af4d-f5ac6a359c38","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"a5d356b1-3180-412a-8dea-76750349e251","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=57fd0aa1-6d66-4aee-9de0-7b7661d60c4b"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/60474a7ad191"]}}
{"level":"debug","ts":"2026-07-06T20:06:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"56bbc0f8-7701-4072-af4d-f5ac6a359c38","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/60474a7ad191"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=57fd0aa1-6d66-4aee-9de0-7b7661d60c4b"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"a5d356b1-3180-412a-8dea-76750349e251","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"40e3d5353e8d81831797688a39423707c6bf92a8999fa3557bb5c03dd7161fa0"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.42:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-035267.apps.0ddafa3d-b0a0-4bcd-9d42-60474a7ad191.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T20:06:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"56bbc0f8-7701-4072-af4d-f5ac6a359c38","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:06:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"56bbc0f8-7701-4072-af4d-f5ac6a359c38","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:06:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"56bbc0f8-7701-4072-af4d-f5ac6a359c38","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-035267/rate-test-model-035267\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:06:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"56bbc0f8-7701-4072-af4d-f5ac6a359c38","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-06T20:06:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"56bbc0f8-7701-4072-af4d-f5ac6a359c38","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T20:06:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"56bbc0f8-7701-4072-af4d-f5ac6a359c38","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-06T20:06:11Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"56bbc0f8-7701-4072-af4d-f5ac6a359c38","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T20:06:11Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"56bbc0f8-7701-4072-af4d-f5ac6a359c38","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T20:06:11Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"af8792ce-73d1-4df9-8c5e-630c58de40b9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:52020","PortSpecifier":{"PortValue":52020}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.41:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"af8792ce-73d1-4df9-8c5e-630c58de40b9","method":"POST","path":"/ai-tenant-e2e-shared-a-e1f716/rate-test-model-e1f716/v1/completions","host":"e2e-shared-a-e1f716.apps.0ddafa3d-b0a0-4bcd-9d42-60474a7ad191.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T20:06:11Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"af8792ce-73d1-4df9-8c5e-630c58de40b9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:52020","PortSpecifier":{"PortValue":52020}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.41:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783368371,"nanos":393112680},"http":{"id":"af8792ce-73d1-4df9-8c5e-630c58de40b9","method":"POST","headers":{":authority":"e2e-shared-a-e1f716.apps.0ddafa3d-b0a0-4bcd-9d42-60474a7ad191.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-e1f716/rate-test-model-e1f716/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T20:06:11Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"af8792ce-73d1-4df9-8c5e-630c58de40b9","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1FY2tXa9xd2P5tI7g_HXo87fdCENbN8jyxFmwuiluo8gVWi4C41o7w6FAThU7"}
{"level":"debug","ts":"2026-07-06T20:06:11Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"af8792ce-73d1-4df9-8c5e-630c58de40b9","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-e1f716.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1FY2tXa9xd2P5tI7g_HXo87fdCENbN8jyxFmwuiluo8gVWi4C41o7w6FAThU7\"}"}
{"level":"debug","ts":"2026-07-06T20:06:11Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"af8792ce-73d1-4df9-8c5e-630c58de40b9","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e1f716.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"cd89af91-fc49-415a-844e-75a5362ddc30","keyName":"e2e-rate-a-d99f49","subscription":"e2e-rate-iso-a-d99f49","tenant":"e2e-shared-a-e1f716","userId":"cd89af91-fc49-415a-844e-75a5362ddc30","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-06T20:06:11Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"af8792ce-73d1-4df9-8c5e-630c58de40b9","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-e1f716.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-e1f716/rate-test-model-e1f716\",\"requestedSubscription\":\"e2e-rate-iso-a-d99f49\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-06T20:06:11Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"af8792ce-73d1-4df9-8c5e-630c58de40b9","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e1f716.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-e1f716","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d99f49","namespace":"ai-tenant-e2e-shared-a-e1f716","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-06T20:06:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"af8792ce-73d1-4df9-8c5e-630c58de40b9","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T20:06:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"af8792ce-73d1-4df9-8c5e-630c58de40b9","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:06:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"af8792ce-73d1-4df9-8c5e-630c58de40b9","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:06:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"af8792ce-73d1-4df9-8c5e-630c58de40b9","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:06:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"af8792ce-73d1-4df9-8c5e-630c58de40b9","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e1f716/rate-test-model-e1f716\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:06:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"af8792ce-73d1-4df9-8c5e-630c58de40b9","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T20:06:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"af8792ce-73d1-4df9-8c5e-630c58de40b9","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-d99f49"}
{"level":"debug","ts":"2026-07-06T20:06:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"af8792ce-73d1-4df9-8c5e-630c58de40b9","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T20:06:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"af8792ce-73d1-4df9-8c5e-630c58de40b9","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"cd89af91-fc49-415a-844e-75a5362ddc30","keyName":"e2e-rate-a-d99f49","selected_subscription":"e2e-rate-iso-a-d99f49","selected_subscription_key":"ai-tenant-e2e-shared-a-e1f716/e2e-rate-iso-a-d99f49@ai-tenant-e2e-shared-a-e1f716/rate-test-model-e1f716","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-e1f716","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d99f49","namespace":"ai-tenant-e2e-shared-a-e1f716","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-06T20:06:11Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"af8792ce-73d1-4df9-8c5e-630c58de40b9","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T20:06:11Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"af8792ce-73d1-4df9-8c5e-630c58de40b9","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T20:06:12Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f5daf7c6-68ce-43d4-8dc3-571c3915d1e3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:52034","PortSpecifier":{"PortValue":52034}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.41:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f5daf7c6-68ce-43d4-8dc3-571c3915d1e3","method":"POST","path":"/ai-tenant-e2e-shared-a-e1f716/rate-test-model-e1f716/v1/completions","host":"e2e-shared-a-e1f716.apps.0ddafa3d-b0a0-4bcd-9d42-60474a7ad191.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T20:06:12Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f5daf7c6-68ce-43d4-8dc3-571c3915d1e3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:52034","PortSpecifier":{"PortValue":52034}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.41:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783368372,"nanos":430569187},"http":{"id":"f5daf7c6-68ce-43d4-8dc3-571c3915d1e3","method":"POST","headers":{":authority":"e2e-shared-a-e1f716.apps.0ddafa3d-b0a0-4bcd-9d42-60474a7ad191.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-e1f716/rate-test-model-e1f716/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T20:06:12Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f5daf7c6-68ce-43d4-8dc3-571c3915d1e3","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1FY2tXa9xd2P5tI7g_HXo87fdCENbN8jyxFmwuiluo8gVWi4C41o7w6FAThU7"}
{"level":"debug","ts":"2026-07-06T20:06:12Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f5daf7c6-68ce-43d4-8dc3-571c3915d1e3","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-e1f716.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1FY2tXa9xd2P5tI7g_HXo87fdCENbN8jyxFmwuiluo8gVWi4C41o7w6FAThU7\"}"}
{"level":"debug","ts":"2026-07-06T20:06:12Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f5daf7c6-68ce-43d4-8dc3-571c3915d1e3","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e1f716.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"cd89af91-fc49-415a-844e-75a5362ddc30","keyName":"e2e-rate-a-d99f49","subscription":"e2e-rate-iso-a-d99f49","tenant":"e2e-shared-a-e1f716","userId":"cd89af91-fc49-415a-844e-75a5362ddc30","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-06T20:06:12Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f5daf7c6-68ce-43d4-8dc3-571c3915d1e3","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-e1f716.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-e1f716/rate-test-model-e1f716\",\"requestedSubscription\":\"e2e-rate-iso-a-d99f49\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-06T20:06:12Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f5daf7c6-68ce-43d4-8dc3-571c3915d1e3","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e1f716.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-e1f716","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d99f49","namespace":"ai-tenant-e2e-shared-a-e1f716","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-06T20:06:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f5daf7c6-68ce-43d4-8dc3-571c3915d1e3","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T20:06:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f5daf7c6-68ce-43d4-8dc3-571c3915d1e3","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:06:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f5daf7c6-68ce-43d4-8dc3-571c3915d1e3","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:06:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f5daf7c6-68ce-43d4-8dc3-571c3915d1e3","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e1f716/rate-test-model-e1f716\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:06:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f5daf7c6-68ce-43d4-8dc3-571c3915d1e3","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:06:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f5daf7c6-68ce-43d4-8dc3-571c3915d1e3","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-d99f49"}
{"level":"debug","ts":"2026-07-06T20:06:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f5daf7c6-68ce-43d4-8dc3-571c3915d1e3","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T20:06:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f5daf7c6-68ce-43d4-8dc3-571c3915d1e3","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T20:06:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f5daf7c6-68ce-43d4-8dc3-571c3915d1e3","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"cd89af91-fc49-415a-844e-75a5362ddc30","keyName":"e2e-rate-a-d99f49","selected_subscription":"e2e-rate-iso-a-d99f49","selected_subscription_key":"ai-tenant-e2e-shared-a-e1f716/e2e-rate-iso-a-d99f49@ai-tenant-e2e-shared-a-e1f716/rate-test-model-e1f716","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-e1f716","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d99f49","namespace":"ai-tenant-e2e-shared-a-e1f716","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-06T20:06:12Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f5daf7c6-68ce-43d4-8dc3-571c3915d1e3","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T20:06:12Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f5daf7c6-68ce-43d4-8dc3-571c3915d1e3","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T20:06:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"25bed615-56b2-4711-9354-5d6b3d390b7c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:52046","PortSpecifier":{"PortValue":52046}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.41:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"25bed615-56b2-4711-9354-5d6b3d390b7c","method":"POST","path":"/ai-tenant-e2e-shared-a-e1f716/rate-test-model-e1f716/v1/completions","host":"e2e-shared-a-e1f716.apps.0ddafa3d-b0a0-4bcd-9d42-60474a7ad191.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T20:06:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"25bed615-56b2-4711-9354-5d6b3d390b7c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:52046","PortSpecifier":{"PortValue":52046}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.41:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783368373,"nanos":465692529},"http":{"id":"25bed615-56b2-4711-9354-5d6b3d390b7c","method":"POST","headers":{":authority":"e2e-shared-a-e1f716.apps.0ddafa3d-b0a0-4bcd-9d42-60474a7ad191.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-e1f716/rate-test-model-e1f716/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T20:06:13Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"25bed615-56b2-4711-9354-5d6b3d390b7c","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1FY2tXa9xd2P5tI7g_HXo87fdCENbN8jyxFmwuiluo8gVWi4C41o7w6FAThU7"}
{"level":"debug","ts":"2026-07-06T20:06:13Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"25bed615-56b2-4711-9354-5d6b3d390b7c","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-e1f716.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1FY2tXa9xd2P5tI7g_HXo87fdCENbN8jyxFmwuiluo8gVWi4C41o7w6FAThU7\"}"}
{"level":"debug","ts":"2026-07-06T20:06:13Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"25bed615-56b2-4711-9354-5d6b3d390b7c","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e1f716.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"cd89af91-fc49-415a-844e-75a5362ddc30","keyName":"e2e-rate-a-d99f49","subscription":"e2e-rate-iso-a-d99f49","tenant":"e2e-shared-a-e1f716","userId":"cd89af91-fc49-415a-844e-75a5362ddc30","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-06T20:06:13Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"25bed615-56b2-4711-9354-5d6b3d390b7c","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-e1f716.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-e1f716/rate-test-model-e1f716\",\"requestedSubscription\":\"e2e-rate-iso-a-d99f49\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-06T20:06:13Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"25bed615-56b2-4711-9354-5d6b3d390b7c","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e1f716.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-e1f716","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d99f49","namespace":"ai-tenant-e2e-shared-a-e1f716","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-06T20:06:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"25bed615-56b2-4711-9354-5d6b3d390b7c","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T20:06:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"25bed615-56b2-4711-9354-5d6b3d390b7c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:06:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"25bed615-56b2-4711-9354-5d6b3d390b7c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:06:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"25bed615-56b2-4711-9354-5d6b3d390b7c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e1f716/rate-test-model-e1f716\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:06:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"25bed615-56b2-4711-9354-5d6b3d390b7c","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:06:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"25bed615-56b2-4711-9354-5d6b3d390b7c","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T20:06:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"25bed615-56b2-4711-9354-5d6b3d390b7c","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-d99f49"}
{"level":"debug","ts":"2026-07-06T20:06:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"25bed615-56b2-4711-9354-5d6b3d390b7c","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T20:06:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"25bed615-56b2-4711-9354-5d6b3d390b7c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"cd89af91-fc49-415a-844e-75a5362ddc30","keyName":"e2e-rate-a-d99f49","selected_subscription":"e2e-rate-iso-a-d99f49","selected_subscription_key":"ai-tenant-e2e-shared-a-e1f716/e2e-rate-iso-a-d99f49@ai-tenant-e2e-shared-a-e1f716/rate-test-model-e1f716","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-e1f716","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d99f49","namespace":"ai-tenant-e2e-shared-a-e1f716","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-06T20:06:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"25bed615-56b2-4711-9354-5d6b3d390b7c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T20:06:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"25bed615-56b2-4711-9354-5d6b3d390b7c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T20:06:14Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f8a00ac7-dfc4-4cc4-9e57-d0f1767e8c32","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:52062","PortSpecifier":{"PortValue":52062}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.41:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f8a00ac7-dfc4-4cc4-9e57-d0f1767e8c32","method":"POST","path":"/ai-tenant-e2e-shared-a-e1f716/rate-test-model-e1f716/v1/completions","host":"e2e-shared-a-e1f716.apps.0ddafa3d-b0a0-4bcd-9d42-60474a7ad191.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T20:06:14Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f8a00ac7-dfc4-4cc4-9e57-d0f1767e8c32","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:52062","PortSpecifier":{"PortValue":52062}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.41:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783368374,"nanos":504704199},"http":{"id":"f8a00ac7-dfc4-4cc4-9e57-d0f1767e8c32","method":"POST","headers":{":authority":"e2e-shared-a-e1f716.apps.0ddafa3d-b0a0-4bcd-9d42-60474a7ad191.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-e1f716/rate-test-model-e1f716/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T20:06:14Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f8a00ac7-dfc4-4cc4-9e57-d0f1767e8c32","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1FY2tXa9xd2P5tI7g_HXo87fdCENbN8jyxFmwuiluo8gVWi4C41o7w6FAThU7"}
{"level":"debug","ts":"2026-07-06T20:06:14Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f8a00ac7-dfc4-4cc4-9e57-d0f1767e8c32","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-e1f716.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1FY2tXa9xd2P5tI7g_HXo87fdCENbN8jyxFmwuiluo8gVWi4C41o7w6FAThU7\"}"}
{"level":"debug","ts":"2026-07-06T20:06:14Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f8a00ac7-dfc4-4cc4-9e57-d0f1767e8c32","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e1f716.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"cd89af91-fc49-415a-844e-75a5362ddc30","keyName":"e2e-rate-a-d99f49","subscription":"e2e-rate-iso-a-d99f49","tenant":"e2e-shared-a-e1f716","userId":"cd89af91-fc49-415a-844e-75a5362ddc30","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-06T20:06:14Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f8a00ac7-dfc4-4cc4-9e57-d0f1767e8c32","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-e1f716.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-e1f716/rate-test-model-e1f716\",\"requestedSubscription\":\"e2e-rate-iso-a-d99f49\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-06T20:06:14Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f8a00ac7-dfc4-4cc4-9e57-d0f1767e8c32","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e1f716.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-e1f716","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d99f49","namespace":"ai-tenant-e2e-shared-a-e1f716","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-06T20:06:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f8a00ac7-dfc4-4cc4-9e57-d0f1767e8c32","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T20:06:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f8a00ac7-dfc4-4cc4-9e57-d0f1767e8c32","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:06:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f8a00ac7-dfc4-4cc4-9e57-d0f1767e8c32","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:06:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f8a00ac7-dfc4-4cc4-9e57-d0f1767e8c32","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:06:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f8a00ac7-dfc4-4cc4-9e57-d0f1767e8c32","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e1f716/rate-test-model-e1f716\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:06:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f8a00ac7-dfc4-4cc4-9e57-d0f1767e8c32","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T20:06:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f8a00ac7-dfc4-4cc4-9e57-d0f1767e8c32","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T20:06:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f8a00ac7-dfc4-4cc4-9e57-d0f1767e8c32","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-d99f49"}
{"level":"debug","ts":"2026-07-06T20:06:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f8a00ac7-dfc4-4cc4-9e57-d0f1767e8c32","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"cd89af91-fc49-415a-844e-75a5362ddc30","keyName":"e2e-rate-a-d99f49","selected_subscription":"e2e-rate-iso-a-d99f49","selected_subscription_key":"ai-tenant-e2e-shared-a-e1f716/e2e-rate-iso-a-d99f49@ai-tenant-e2e-shared-a-e1f716/rate-test-model-e1f716","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-e1f716","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d99f49","namespace":"ai-tenant-e2e-shared-a-e1f716","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-06T20:06:14Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f8a00ac7-dfc4-4cc4-9e57-d0f1767e8c32","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T20:06:14Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f8a00ac7-dfc4-4cc4-9e57-d0f1767e8c32","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T20:06:15Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1994aa60-4c53-4d7c-9e48-e97aeae841e6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:41304","PortSpecifier":{"PortValue":41304}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.41:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1994aa60-4c53-4d7c-9e48-e97aeae841e6","method":"POST","path":"/ai-tenant-e2e-shared-a-e1f716/rate-test-model-e1f716/v1/completions","host":"e2e-shared-a-e1f716.apps.0ddafa3d-b0a0-4bcd-9d42-60474a7ad191.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T20:06:15Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1994aa60-4c53-4d7c-9e48-e97aeae841e6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:41304","PortSpecifier":{"PortValue":41304}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.41:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783368375,"nanos":541138794},"http":{"id":"1994aa60-4c53-4d7c-9e48-e97aeae841e6","method":"POST","headers":{":authority":"e2e-shared-a-e1f716.apps.0ddafa3d-b0a0-4bcd-9d42-60474a7ad191.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-e1f716/rate-test-model-e1f716/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T20:06:15Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1994aa60-4c53-4d7c-9e48-e97aeae841e6","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1FY2tXa9xd2P5tI7g_HXo87fdCENbN8jyxFmwuiluo8gVWi4C41o7w6FAThU7"}
{"level":"debug","ts":"2026-07-06T20:06:15Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1994aa60-4c53-4d7c-9e48-e97aeae841e6","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-e1f716.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1FY2tXa9xd2P5tI7g_HXo87fdCENbN8jyxFmwuiluo8gVWi4C41o7w6FAThU7\"}"}
{"level":"debug","ts":"2026-07-06T20:06:15Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1994aa60-4c53-4d7c-9e48-e97aeae841e6","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e1f716.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"cd89af91-fc49-415a-844e-75a5362ddc30","keyName":"e2e-rate-a-d99f49","subscription":"e2e-rate-iso-a-d99f49","tenant":"e2e-shared-a-e1f716","userId":"cd89af91-fc49-415a-844e-75a5362ddc30","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-06T20:06:15Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1994aa60-4c53-4d7c-9e48-e97aeae841e6","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-e1f716.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-e1f716/rate-test-model-e1f716\",\"requestedSubscription\":\"e2e-rate-iso-a-d99f49\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-06T20:06:15Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1994aa60-4c53-4d7c-9e48-e97aeae841e6","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e1f716.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-e1f716","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d99f49","namespace":"ai-tenant-e2e-shared-a-e1f716","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-06T20:06:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1994aa60-4c53-4d7c-9e48-e97aeae841e6","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T20:06:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1994aa60-4c53-4d7c-9e48-e97aeae841e6","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:06:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1994aa60-4c53-4d7c-9e48-e97aeae841e6","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:06:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1994aa60-4c53-4d7c-9e48-e97aeae841e6","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e1f716/rate-test-model-e1f716\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:06:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1994aa60-4c53-4d7c-9e48-e97aeae841e6","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:06:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1994aa60-4c53-4d7c-9e48-e97aeae841e6","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-d99f49"}
{"level":"debug","ts":"2026-07-06T20:06:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1994aa60-4c53-4d7c-9e48-e97aeae841e6","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T20:06:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1994aa60-4c53-4d7c-9e48-e97aeae841e6","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T20:06:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1994aa60-4c53-4d7c-9e48-e97aeae841e6","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"cd89af91-fc49-415a-844e-75a5362ddc30","keyName":"e2e-rate-a-d99f49","selected_subscription":"e2e-rate-iso-a-d99f49","selected_subscription_key":"ai-tenant-e2e-shared-a-e1f716/e2e-rate-iso-a-d99f49@ai-tenant-e2e-shared-a-e1f716/rate-test-model-e1f716","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-e1f716","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d99f49","namespace":"ai-tenant-e2e-shared-a-e1f716","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-06T20:06:15Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1994aa60-4c53-4d7c-9e48-e97aeae841e6","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T20:06:15Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1994aa60-4c53-4d7c-9e48-e97aeae841e6","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T20:06:16Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c916831b-e164-4c0f-96a9-89b8a116de3c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:41308","PortSpecifier":{"PortValue":41308}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.41:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c916831b-e164-4c0f-96a9-89b8a116de3c","method":"POST","path":"/ai-tenant-e2e-shared-a-e1f716/rate-test-model-e1f716/v1/completions","host":"e2e-shared-a-e1f716.apps.0ddafa3d-b0a0-4bcd-9d42-60474a7ad191.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T20:06:16Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c916831b-e164-4c0f-96a9-89b8a116de3c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:41308","PortSpecifier":{"PortValue":41308}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.41:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783368376,"nanos":577941863},"http":{"id":"c916831b-e164-4c0f-96a9-89b8a116de3c","method":"POST","headers":{":authority":"e2e-shared-a-e1f716.apps.0ddafa3d-b0a0-4bcd-9d42-60474a7ad191.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-e1f716/rate-test-model-e1f716/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T20:06:16Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"c916831b-e164-4c0f-96a9-89b8a116de3c","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1FY2tXa9xd2P5tI7g_HXo87fdCENbN8jyxFmwuiluo8gVWi4C41o7w6FAThU7"}
{"level":"debug","ts":"2026-07-06T20:06:16Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c916831b-e164-4c0f-96a9-89b8a116de3c","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-e1f716.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1FY2tXa9xd2P5tI7g_HXo87fdCENbN8jyxFmwuiluo8gVWi4C41o7w6FAThU7\"}"}
{"level":"debug","ts":"2026-07-06T20:06:16Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c916831b-e164-4c0f-96a9-89b8a116de3c","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e1f716.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"cd89af91-fc49-415a-844e-75a5362ddc30","keyName":"e2e-rate-a-d99f49","subscription":"e2e-rate-iso-a-d99f49","tenant":"e2e-shared-a-e1f716","userId":"cd89af91-fc49-415a-844e-75a5362ddc30","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-06T20:06:16Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c916831b-e164-4c0f-96a9-89b8a116de3c","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-e1f716.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-e1f716/rate-test-model-e1f716\",\"requestedSubscription\":\"e2e-rate-iso-a-d99f49\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-06T20:06:16Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c916831b-e164-4c0f-96a9-89b8a116de3c","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e1f716.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-e1f716","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d99f49","namespace":"ai-tenant-e2e-shared-a-e1f716","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-06T20:06:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"c916831b-e164-4c0f-96a9-89b8a116de3c","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T20:06:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c916831b-e164-4c0f-96a9-89b8a116de3c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:06:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c916831b-e164-4c0f-96a9-89b8a116de3c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:06:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c916831b-e164-4c0f-96a9-89b8a116de3c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e1f716/rate-test-model-e1f716\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:06:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c916831b-e164-4c0f-96a9-89b8a116de3c","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:06:16Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c916831b-e164-4c0f-96a9-89b8a116de3c","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T20:06:16Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c916831b-e164-4c0f-96a9-89b8a116de3c","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-d99f49"}
{"level":"debug","ts":"2026-07-06T20:06:16Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c916831b-e164-4c0f-96a9-89b8a116de3c","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T20:06:16Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c916831b-e164-4c0f-96a9-89b8a116de3c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"cd89af91-fc49-415a-844e-75a5362ddc30","keyName":"e2e-rate-a-d99f49","selected_subscription":"e2e-rate-iso-a-d99f49","selected_subscription_key":"ai-tenant-e2e-shared-a-e1f716/e2e-rate-iso-a-d99f49@ai-tenant-e2e-shared-a-e1f716/rate-test-model-e1f716","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-e1f716","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d99f49","namespace":"ai-tenant-e2e-shared-a-e1f716","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-06T20:06:16Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c916831b-e164-4c0f-96a9-89b8a116de3c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T20:06:16Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c916831b-e164-4c0f-96a9-89b8a116de3c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T20:06:16Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f25ec8a7-0951-474d-9304-013ff2c293b0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:48502","PortSpecifier":{"PortValue":48502}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.42:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f25ec8a7-0951-474d-9304-013ff2c293b0","method":"POST","path":"/ai-tenant-e2e-shared-b-035267/rate-test-model-035267/v1/completions","host":"e2e-shared-b-035267.apps.0ddafa3d-b0a0-4bcd-9d42-60474a7ad191.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T20:06:16Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f25ec8a7-0951-474d-9304-013ff2c293b0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:48502","PortSpecifier":{"PortValue":48502}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.42:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783368376,"nanos":615068833},"http":{"id":"f25ec8a7-0951-474d-9304-013ff2c293b0","method":"POST","headers":{":authority":"e2e-shared-b-035267.apps.0ddafa3d-b0a0-4bcd-9d42-60474a7ad191.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-035267/rate-test-model-035267/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T20:06:16Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f25ec8a7-0951-474d-9304-013ff2c293b0","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-zFQQtukOip4DvaIh_j0xNtYqvBvhdqK6Y9JzHToNqR8ALc4l7ZC3cq5EcuvQ"}
{"level":"debug","ts":"2026-07-06T20:06:16Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f25ec8a7-0951-474d-9304-013ff2c293b0","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-035267.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-zFQQtukOip4DvaIh_j0xNtYqvBvhdqK6Y9JzHToNqR8ALc4l7ZC3cq5EcuvQ\"}"}
{"level":"debug","ts":"2026-07-06T20:06:16Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f25ec8a7-0951-474d-9304-013ff2c293b0","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-035267.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"aeb15a2b-70b4-43c8-9c5f-8d28c021edf4","keyName":"e2e-rate-b-d99f49","subscription":"e2e-rate-iso-b-d99f49","tenant":"e2e-shared-b-035267","userId":"aeb15a2b-70b4-43c8-9c5f-8d28c021edf4","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-06T20:06:16Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f25ec8a7-0951-474d-9304-013ff2c293b0","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-035267.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-035267/rate-test-model-035267\",\"requestedSubscription\":\"e2e-rate-iso-b-d99f49\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-06T20:06:16Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f25ec8a7-0951-474d-9304-013ff2c293b0","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-035267.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-035267","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-d99f49","namespace":"ai-tenant-e2e-shared-b-035267","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-06T20:06:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f25ec8a7-0951-474d-9304-013ff2c293b0","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T20:06:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f25ec8a7-0951-474d-9304-013ff2c293b0","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:06:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f25ec8a7-0951-474d-9304-013ff2c293b0","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:06:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f25ec8a7-0951-474d-9304-013ff2c293b0","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:06:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f25ec8a7-0951-474d-9304-013ff2c293b0","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-035267/rate-test-model-035267\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:06:16Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f25ec8a7-0951-474d-9304-013ff2c293b0","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T20:06:16Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f25ec8a7-0951-474d-9304-013ff2c293b0","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-d99f49"}
{"level":"debug","ts":"2026-07-06T20:06:16Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f25ec8a7-0951-474d-9304-013ff2c293b0","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T20:06:16Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f25ec8a7-0951-474d-9304-013ff2c293b0","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"aeb15a2b-70b4-43c8-9c5f-8d28c021edf4","keyName":"e2e-rate-b-d99f49","selected_subscription":"e2e-rate-iso-b-d99f49","selected_subscription_key":"ai-tenant-e2e-shared-b-035267/e2e-rate-iso-b-d99f49@ai-tenant-e2e-shared-b-035267/rate-test-model-035267","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-035267","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-d99f49","namespace":"ai-tenant-e2e-shared-b-035267","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-06T20:06:16Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f25ec8a7-0951-474d-9304-013ff2c293b0","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T20:06:16Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f25ec8a7-0951-474d-9304-013ff2c293b0","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T20:06:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f04bebfc01ac121bf2926f74fe62ccab94719519b552c0eda8b502d2fc40535e"}
{"level":"info","ts":"2026-07-06T20:06:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/913da5197eeaedb037a0fccfed660b4abf390f6d82321ffebdcd045b5cddd00e"}
{"level":"info","ts":"2026-07-06T20:06:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/202e86462b4a9055ac07849a602d5adc57fa7f0b716c8fafc9d7f4606f5f7610"}
{"level":"info","ts":"2026-07-06T20:06:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/be10f31b29274d7fc7a2ff52919f84b0471fef38f86e2848b8f4968ec9e035c8"}
{"level":"info","ts":"2026-07-06T20:06:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/42974c8df0704b09e3878556fa0217110a9f2f94c1bf4eaa27ca80dbd2df4bfb"}
{"level":"info","ts":"2026-07-06T20:06:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/44d5a1f2ebde73e06d9573326543ff88130f25e85bf3495a520eabb14c34750a"}
{"level":"info","ts":"2026-07-06T20:06:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4dd2f6ada48b63f6212a40fd8e7be79f33eeac2b4dc6b670c3c2d96a5eba0424"}
{"level":"info","ts":"2026-07-06T20:06:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6fff1d9d9ed10c87624eb7f0a63c02edef9402e389de41761d0f22d81ec4e3a4"}
{"level":"info","ts":"2026-07-06T20:06:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ff910f55c001b36430840202a6446a61222ea7ad2935566f91b7f61559ff425b"}
{"level":"info","ts":"2026-07-06T20:06:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6e38df8dbfc86f0cfd7668c8dbbba60997a349a939a17f932f441a384886871c"}
{"level":"info","ts":"2026-07-06T20:06:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e88012a6e19d0849a8e05ff6b538c3c5f2350430b3110fd6458061dbc61430cd"}
{"level":"info","ts":"2026-07-06T20:06:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/557c9fa39cba552556d385df2ec1284ac39644dcf1a966f781da1d98866bc2e1"}
{"level":"info","ts":"2026-07-06T20:06:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c290fd37072c2652a738930d66454761d0ad2c881fd01b4555d88cd653b258bf"}
{"level":"info","ts":"2026-07-06T20:06:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e3da8387e57c914b6d984a3f13179a926ed680f8655fdfa9eda72393f5810c10"}
{"level":"info","ts":"2026-07-06T20:06:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/10ab7997502692fb8bfa82ad74bbb1773ee0111d4792eb020da3fc74ec8fcce6"}
{"level":"info","ts":"2026-07-06T20:06:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/81ab0c4c6095e5c311389af030cede5fc3b12956d6dc6ac00577314d30947009"}
{"level":"info","ts":"2026-07-06T20:06:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/aa8785305a08abe890ff7dda026ae9e6cebf659c57e7cbbd766e12c5e21bc37e"}
{"level":"info","ts":"2026-07-06T20:06:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/587b77012c9a8af1e9972a639b5c14b5be92391d71cd7aa625674d0b445047ae"}
{"level":"info","ts":"2026-07-06T20:07:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/40e3d5353e8d81831797688a39423707c6bf92a8999fa3557bb5c03dd7161fa0"}
{"level":"info","ts":"2026-07-06T20:07:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9a286657a61605a6c4db687cecdec77fb08d52d653428a8ecc52e94838d856af"}