{"level":"info","ts":"2026-07-21T17:47:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4fde31eba84988e43411761b1438fb254423980b27e0d413a129891c7bd59475"}
{"level":"info","ts":"2026-07-21T17:47:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"102db7ad381949ac93de24eccb1546ce9ff7462b2e3b2b28aeaa90984ac95163","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:47:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4fde31eba84988e43411761b1438fb254423980b27e0d413a129891c7bd59475","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T17:47:04Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T17:47:04Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4fde31eba84988e43411761b1438fb254423980b27e0d413a129891c7bd59475"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T17:47:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9c3c13449cd218695c978de67f0b60951d42ecaed24c76534e69f5e6555d0c53"}
{"level":"info","ts":"2026-07-21T17:47:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4fde31eba84988e43411761b1438fb254423980b27e0d413a129891c7bd59475","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:47:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9c3c13449cd218695c978de67f0b60951d42ecaed24c76534e69f5e6555d0c53","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T17:47:04Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T17:47:04Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9c3c13449cd218695c978de67f0b60951d42ecaed24c76534e69f5e6555d0c53"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T17:47:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/102db7ad381949ac93de24eccb1546ce9ff7462b2e3b2b28aeaa90984ac95163"}
{"level":"info","ts":"2026-07-21T17:47:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9c3c13449cd218695c978de67f0b60951d42ecaed24c76534e69f5e6555d0c53","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:47:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"102db7ad381949ac93de24eccb1546ce9ff7462b2e3b2b28aeaa90984ac95163","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:47:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4fde31eba84988e43411761b1438fb254423980b27e0d413a129891c7bd59475","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-21T17:47:04Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-21T17:47:04Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T17:47:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4fde31eba84988e43411761b1438fb254423980b27e0d413a129891c7bd59475"}
{"level":"info","ts":"2026-07-21T17:47:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4fde31eba84988e43411761b1438fb254423980b27e0d413a129891c7bd59475","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:47:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9c3c13449cd218695c978de67f0b60951d42ecaed24c76534e69f5e6555d0c53","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-21T17:47:04Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-21T17:47:04Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T17:47:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9c3c13449cd218695c978de67f0b60951d42ecaed24c76534e69f5e6555d0c53","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:47:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4fde31eba84988e43411761b1438fb254423980b27e0d413a129891c7bd59475","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T17:47:04Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T17:47:04Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4fde31eba84988e43411761b1438fb254423980b27e0d413a129891c7bd59475"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T17:47:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4fde31eba84988e43411761b1438fb254423980b27e0d413a129891c7bd59475","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:47:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e72c9b61a2b6c6b8c3b1c7d62dcf9bf7268c91a732291703a662ea28d273d041","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-21T17:47:04Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-21T17:47:04Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T17:47:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9c3c13449cd218695c978de67f0b60951d42ecaed24c76534e69f5e6555d0c53"}
{"level":"info","ts":"2026-07-21T17:47:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e72c9b61a2b6c6b8c3b1c7d62dcf9bf7268c91a732291703a662ea28d273d041","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:47:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9c3c13449cd218695c978de67f0b60951d42ecaed24c76534e69f5e6555d0c53","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T17:47:04Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T17:47:04Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9c3c13449cd218695c978de67f0b60951d42ecaed24c76534e69f5e6555d0c53"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T17:47:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9c3c13449cd218695c978de67f0b60951d42ecaed24c76534e69f5e6555d0c53","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:47:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4fde31eba84988e43411761b1438fb254423980b27e0d413a129891c7bd59475","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-21T17:47:04Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-21T17:47:04Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T17:47:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4fde31eba84988e43411761b1438fb254423980b27e0d413a129891c7bd59475"}
{"level":"info","ts":"2026-07-21T17:47:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4fde31eba84988e43411761b1438fb254423980b27e0d413a129891c7bd59475","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:47:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e72c9b61a2b6c6b8c3b1c7d62dcf9bf7268c91a732291703a662ea28d273d041","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-21T17:47:04Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-21T17:47:04Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T17:47:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e72c9b61a2b6c6b8c3b1c7d62dcf9bf7268c91a732291703a662ea28d273d041"}
{"level":"info","ts":"2026-07-21T17:47:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e72c9b61a2b6c6b8c3b1c7d62dcf9bf7268c91a732291703a662ea28d273d041","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:47:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9c3c13449cd218695c978de67f0b60951d42ecaed24c76534e69f5e6555d0c53","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-21T17:47:04Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-21T17:47:04Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T17:47:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9c3c13449cd218695c978de67f0b60951d42ecaed24c76534e69f5e6555d0c53","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:47:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4fde31eba84988e43411761b1438fb254423980b27e0d413a129891c7bd59475","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T17:47:04Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T17:47:04Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4fde31eba84988e43411761b1438fb254423980b27e0d413a129891c7bd59475"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T17:47:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9c3c13449cd218695c978de67f0b60951d42ecaed24c76534e69f5e6555d0c53"}
{"level":"info","ts":"2026-07-21T17:47:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4fde31eba84988e43411761b1438fb254423980b27e0d413a129891c7bd59475","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:47:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e72c9b61a2b6c6b8c3b1c7d62dcf9bf7268c91a732291703a662ea28d273d041","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T17:47:04Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T17:47:04Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e72c9b61a2b6c6b8c3b1c7d62dcf9bf7268c91a732291703a662ea28d273d041"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T17:47:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4fde31eba84988e43411761b1438fb254423980b27e0d413a129891c7bd59475"}
{"level":"info","ts":"2026-07-21T17:47:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e72c9b61a2b6c6b8c3b1c7d62dcf9bf7268c91a732291703a662ea28d273d041","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:47:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"72fcb6314b0ce63404ef0bc1b7fccc688aa12f2a8c5a5d3e9ea339d9091c3fed","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-21T17:47:04Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-21T17:47:04Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T17:47:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"72fcb6314b0ce63404ef0bc1b7fccc688aa12f2a8c5a5d3e9ea339d9091c3fed","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:47:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9c3c13449cd218695c978de67f0b60951d42ecaed24c76534e69f5e6555d0c53","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T17:47:04Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T17:47:04Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9c3c13449cd218695c978de67f0b60951d42ecaed24c76534e69f5e6555d0c53"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T17:47:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e72c9b61a2b6c6b8c3b1c7d62dcf9bf7268c91a732291703a662ea28d273d041"}
{"level":"info","ts":"2026-07-21T17:47:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9c3c13449cd218695c978de67f0b60951d42ecaed24c76534e69f5e6555d0c53","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:47:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"477340e14eaf095def8aa0f3ad9dce54536e1c6cb053a17c1478ab314d8cf56a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-21T17:47:04Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-21T17:47:04Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T17:47:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/72fcb6314b0ce63404ef0bc1b7fccc688aa12f2a8c5a5d3e9ea339d9091c3fed"}
{"level":"info","ts":"2026-07-21T17:47:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"477340e14eaf095def8aa0f3ad9dce54536e1c6cb053a17c1478ab314d8cf56a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:47:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4fde31eba84988e43411761b1438fb254423980b27e0d413a129891c7bd59475","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:47:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e72c9b61a2b6c6b8c3b1c7d62dcf9bf7268c91a732291703a662ea28d273d041","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:47:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"72fcb6314b0ce63404ef0bc1b7fccc688aa12f2a8c5a5d3e9ea339d9091c3fed","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T17:47:04Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T17:47:04Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["72fcb6314b0ce63404ef0bc1b7fccc688aa12f2a8c5a5d3e9ea339d9091c3fed"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T17:47:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"72fcb6314b0ce63404ef0bc1b7fccc688aa12f2a8c5a5d3e9ea339d9091c3fed","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:47:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9c3c13449cd218695c978de67f0b60951d42ecaed24c76534e69f5e6555d0c53","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:47:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"477340e14eaf095def8aa0f3ad9dce54536e1c6cb053a17c1478ab314d8cf56a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-21T17:47:04Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-21T17:47:04Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T17:47:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/477340e14eaf095def8aa0f3ad9dce54536e1c6cb053a17c1478ab314d8cf56a"}
{"level":"info","ts":"2026-07-21T17:47:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"477340e14eaf095def8aa0f3ad9dce54536e1c6cb053a17c1478ab314d8cf56a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:47:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"209eeaa6b94ebc188acacd1f7603ab3c6648071d769fb67e0119657ec2701700","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-21T17:47:04Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-21T17:47:04Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T17:47:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9c3c13449cd218695c978de67f0b60951d42ecaed24c76534e69f5e6555d0c53"}
{"level":"info","ts":"2026-07-21T17:47:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4fde31eba84988e43411761b1438fb254423980b27e0d413a129891c7bd59475"}
{"level":"info","ts":"2026-07-21T17:47:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e72c9b61a2b6c6b8c3b1c7d62dcf9bf7268c91a732291703a662ea28d273d041"}
{"level":"info","ts":"2026-07-21T17:47:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"209eeaa6b94ebc188acacd1f7603ab3c6648071d769fb67e0119657ec2701700","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:47:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"72fcb6314b0ce63404ef0bc1b7fccc688aa12f2a8c5a5d3e9ea339d9091c3fed","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:47:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7f4e8382d9c666dd5d6bba7c2b267290c2ccf91932deb8399384764e9593db72","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-21T17:47:04Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-21T17:47:04Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T17:47:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/209eeaa6b94ebc188acacd1f7603ab3c6648071d769fb67e0119657ec2701700"}
{"level":"info","ts":"2026-07-21T17:47:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/72fcb6314b0ce63404ef0bc1b7fccc688aa12f2a8c5a5d3e9ea339d9091c3fed"}
{"level":"info","ts":"2026-07-21T17:47:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7f4e8382d9c666dd5d6bba7c2b267290c2ccf91932deb8399384764e9593db72","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:47:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"477340e14eaf095def8aa0f3ad9dce54536e1c6cb053a17c1478ab314d8cf56a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:47:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"209eeaa6b94ebc188acacd1f7603ab3c6648071d769fb67e0119657ec2701700","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T17:47:04Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T17:47:04Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["209eeaa6b94ebc188acacd1f7603ab3c6648071d769fb67e0119657ec2701700"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T17:47:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/477340e14eaf095def8aa0f3ad9dce54536e1c6cb053a17c1478ab314d8cf56a"}
{"level":"info","ts":"2026-07-21T17:47:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7f4e8382d9c666dd5d6bba7c2b267290c2ccf91932deb8399384764e9593db72"}
{"level":"info","ts":"2026-07-21T17:47:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"209eeaa6b94ebc188acacd1f7603ab3c6648071d769fb67e0119657ec2701700","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:47:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6feda21c0fc67e06fb2e22d8f0e81be19d00adbb8ca121fb8f5dda549f5bcce1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-21T17:47:04Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-21T17:47:04Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T17:47:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/209eeaa6b94ebc188acacd1f7603ab3c6648071d769fb67e0119657ec2701700"}
{"level":"info","ts":"2026-07-21T17:47:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6feda21c0fc67e06fb2e22d8f0e81be19d00adbb8ca121fb8f5dda549f5bcce1"}
{"level":"info","ts":"2026-07-21T17:47:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/209eeaa6b94ebc188acacd1f7603ab3c6648071d769fb67e0119657ec2701700"}
{"level":"info","ts":"2026-07-21T17:47:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6feda21c0fc67e06fb2e22d8f0e81be19d00adbb8ca121fb8f5dda549f5bcce1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:47:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7f4e8382d9c666dd5d6bba7c2b267290c2ccf91932deb8399384764e9593db72","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T17:47:04Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T17:47:04Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7f4e8382d9c666dd5d6bba7c2b267290c2ccf91932deb8399384764e9593db72"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T17:47:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f0705fdb04ae3706a2ce86046daca0e5b73bcf99db56077b0c07a7dd4aab4fe4"}
{"level":"info","ts":"2026-07-21T17:47:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c2d2fb8f5b0afc9bc0f35c8c146d1da07b07bbae7072b20fab84257e11a0f100"}
{"level":"info","ts":"2026-07-21T17:47:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7f4e8382d9c666dd5d6bba7c2b267290c2ccf91932deb8399384764e9593db72","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:47:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"477340e14eaf095def8aa0f3ad9dce54536e1c6cb053a17c1478ab314d8cf56a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T17:47:04Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T17:47:04Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["477340e14eaf095def8aa0f3ad9dce54536e1c6cb053a17c1478ab314d8cf56a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T17:47:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6feda21c0fc67e06fb2e22d8f0e81be19d00adbb8ca121fb8f5dda549f5bcce1"}
{"level":"info","ts":"2026-07-21T17:47:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7f4e8382d9c666dd5d6bba7c2b267290c2ccf91932deb8399384764e9593db72"}
{"level":"info","ts":"2026-07-21T17:47:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3af420a243cfaf94da91cd999a7327a5799f6e0e43264cf7595bbd9e6ca64c9b"}
{"level":"info","ts":"2026-07-21T17:47:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"477340e14eaf095def8aa0f3ad9dce54536e1c6cb053a17c1478ab314d8cf56a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:47:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"209eeaa6b94ebc188acacd1f7603ab3c6648071d769fb67e0119657ec2701700","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:47:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f0705fdb04ae3706a2ce86046daca0e5b73bcf99db56077b0c07a7dd4aab4fe4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T17:47:04Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T17:47:04Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["f0705fdb04ae3706a2ce86046daca0e5b73bcf99db56077b0c07a7dd4aab4fe4"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T17:47:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/226747967f1ad1ee678f5f39ec57b02e54817cf91b2f4131cfdcea96b36016ce"}
{"level":"info","ts":"2026-07-21T17:47:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/477340e14eaf095def8aa0f3ad9dce54536e1c6cb053a17c1478ab314d8cf56a"}
{"level":"info","ts":"2026-07-21T17:47:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f0705fdb04ae3706a2ce86046daca0e5b73bcf99db56077b0c07a7dd4aab4fe4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:47:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c2d2fb8f5b0afc9bc0f35c8c146d1da07b07bbae7072b20fab84257e11a0f100","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T17:47:04Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T17:47:04Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c2d2fb8f5b0afc9bc0f35c8c146d1da07b07bbae7072b20fab84257e11a0f100"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T17:47:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4947733f8c75cb2be93a36747a15df889686c15a18db4494da3a99a80e465a7f"}
{"level":"info","ts":"2026-07-21T17:47:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f0705fdb04ae3706a2ce86046daca0e5b73bcf99db56077b0c07a7dd4aab4fe4"}
{"level":"info","ts":"2026-07-21T17:47:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c2d2fb8f5b0afc9bc0f35c8c146d1da07b07bbae7072b20fab84257e11a0f100","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:47:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6feda21c0fc67e06fb2e22d8f0e81be19d00adbb8ca121fb8f5dda549f5bcce1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T17:47:04Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T17:47:04Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["6feda21c0fc67e06fb2e22d8f0e81be19d00adbb8ca121fb8f5dda549f5bcce1"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T17:47:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b84bf956fa6e7b565ba00271da322e0345b06f89df9b58c75e12baf7c761c8b7"}
{"level":"info","ts":"2026-07-21T17:47:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c2d2fb8f5b0afc9bc0f35c8c146d1da07b07bbae7072b20fab84257e11a0f100"}
{"level":"info","ts":"2026-07-21T17:47:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6feda21c0fc67e06fb2e22d8f0e81be19d00adbb8ca121fb8f5dda549f5bcce1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:47:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7f4e8382d9c666dd5d6bba7c2b267290c2ccf91932deb8399384764e9593db72","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:47:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3af420a243cfaf94da91cd999a7327a5799f6e0e43264cf7595bbd9e6ca64c9b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T17:47:05Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T17:47:05Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3af420a243cfaf94da91cd999a7327a5799f6e0e43264cf7595bbd9e6ca64c9b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T17:47:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6feda21c0fc67e06fb2e22d8f0e81be19d00adbb8ca121fb8f5dda549f5bcce1"}
{"level":"info","ts":"2026-07-21T17:47:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ce9ae44560d24872155b0c11f5bba1a2c9e9ff61413a664817d56dca9260fb39"}
{"level":"info","ts":"2026-07-21T17:47:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3af420a243cfaf94da91cd999a7327a5799f6e0e43264cf7595bbd9e6ca64c9b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:47:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"226747967f1ad1ee678f5f39ec57b02e54817cf91b2f4131cfdcea96b36016ce","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T17:47:05Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T17:47:05Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["226747967f1ad1ee678f5f39ec57b02e54817cf91b2f4131cfdcea96b36016ce"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T17:47:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/afb3c8628ab15f2b141d16b8aab7ae18a962158110f58fb5eb52b5a59507307c"}
{"level":"info","ts":"2026-07-21T17:47:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3af420a243cfaf94da91cd999a7327a5799f6e0e43264cf7595bbd9e6ca64c9b"}
{"level":"info","ts":"2026-07-21T17:47:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"226747967f1ad1ee678f5f39ec57b02e54817cf91b2f4131cfdcea96b36016ce","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:47:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"477340e14eaf095def8aa0f3ad9dce54536e1c6cb053a17c1478ab314d8cf56a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:47:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4947733f8c75cb2be93a36747a15df889686c15a18db4494da3a99a80e465a7f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T17:47:05Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T17:47:05Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4947733f8c75cb2be93a36747a15df889686c15a18db4494da3a99a80e465a7f"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T17:47:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/867845942b8252f5d8d26e1f797c23e0963cc72c48b68848e386d7fdb1b5f718"}
{"level":"info","ts":"2026-07-21T17:47:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/596067d9605c0f72d97e8a12b26266d2c946aa4f861e9a501fe219fe7a909c25"}
{"level":"info","ts":"2026-07-21T17:47:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/226747967f1ad1ee678f5f39ec57b02e54817cf91b2f4131cfdcea96b36016ce"}
{"level":"info","ts":"2026-07-21T17:47:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4947733f8c75cb2be93a36747a15df889686c15a18db4494da3a99a80e465a7f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:47:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f0705fdb04ae3706a2ce86046daca0e5b73bcf99db56077b0c07a7dd4aab4fe4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:47:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b84bf956fa6e7b565ba00271da322e0345b06f89df9b58c75e12baf7c761c8b7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T17:47:05Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T17:47:05Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b84bf956fa6e7b565ba00271da322e0345b06f89df9b58c75e12baf7c761c8b7"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T17:47:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ee3eae7f4f990ad9ad916e25b1634b5713cf96699a46684e4acd478f3fcb0ff2"}
{"level":"info","ts":"2026-07-21T17:47:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/baac29086d8369ca9c79ed73040e1230091a3e0d3d8037699075b6ac58b38198"}
{"level":"info","ts":"2026-07-21T17:47:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b84bf956fa6e7b565ba00271da322e0345b06f89df9b58c75e12baf7c761c8b7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:47:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c2d2fb8f5b0afc9bc0f35c8c146d1da07b07bbae7072b20fab84257e11a0f100","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:47:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6feda21c0fc67e06fb2e22d8f0e81be19d00adbb8ca121fb8f5dda549f5bcce1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:47:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ce9ae44560d24872155b0c11f5bba1a2c9e9ff61413a664817d56dca9260fb39","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T17:47:05Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T17:47:05Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ce9ae44560d24872155b0c11f5bba1a2c9e9ff61413a664817d56dca9260fb39"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T17:47:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4947733f8c75cb2be93a36747a15df889686c15a18db4494da3a99a80e465a7f"}
{"level":"info","ts":"2026-07-21T17:47:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ce9ae44560d24872155b0c11f5bba1a2c9e9ff61413a664817d56dca9260fb39","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:47:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"afb3c8628ab15f2b141d16b8aab7ae18a962158110f58fb5eb52b5a59507307c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T17:47:05Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T17:47:05Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["afb3c8628ab15f2b141d16b8aab7ae18a962158110f58fb5eb52b5a59507307c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T17:47:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b84bf956fa6e7b565ba00271da322e0345b06f89df9b58c75e12baf7c761c8b7"}
{"level":"info","ts":"2026-07-21T17:47:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ce9ae44560d24872155b0c11f5bba1a2c9e9ff61413a664817d56dca9260fb39"}
{"level":"info","ts":"2026-07-21T17:47:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"afb3c8628ab15f2b141d16b8aab7ae18a962158110f58fb5eb52b5a59507307c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:47:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3af420a243cfaf94da91cd999a7327a5799f6e0e43264cf7595bbd9e6ca64c9b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:47:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"867845942b8252f5d8d26e1f797c23e0963cc72c48b68848e386d7fdb1b5f718","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T17:47:05Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T17:47:05Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["867845942b8252f5d8d26e1f797c23e0963cc72c48b68848e386d7fdb1b5f718"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T17:47:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/afb3c8628ab15f2b141d16b8aab7ae18a962158110f58fb5eb52b5a59507307c"}
{"level":"info","ts":"2026-07-21T17:47:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"867845942b8252f5d8d26e1f797c23e0963cc72c48b68848e386d7fdb1b5f718","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:47:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"596067d9605c0f72d97e8a12b26266d2c946aa4f861e9a501fe219fe7a909c25","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T17:47:05Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T17:47:05Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["596067d9605c0f72d97e8a12b26266d2c946aa4f861e9a501fe219fe7a909c25"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T17:47:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/867845942b8252f5d8d26e1f797c23e0963cc72c48b68848e386d7fdb1b5f718"}
{"level":"info","ts":"2026-07-21T17:47:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"596067d9605c0f72d97e8a12b26266d2c946aa4f861e9a501fe219fe7a909c25","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:47:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"226747967f1ad1ee678f5f39ec57b02e54817cf91b2f4131cfdcea96b36016ce","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:47:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ee3eae7f4f990ad9ad916e25b1634b5713cf96699a46684e4acd478f3fcb0ff2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T17:47:05Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T17:47:05Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ee3eae7f4f990ad9ad916e25b1634b5713cf96699a46684e4acd478f3fcb0ff2"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T17:47:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/596067d9605c0f72d97e8a12b26266d2c946aa4f861e9a501fe219fe7a909c25"}
{"level":"info","ts":"2026-07-21T17:47:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ee3eae7f4f990ad9ad916e25b1634b5713cf96699a46684e4acd478f3fcb0ff2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:47:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"baac29086d8369ca9c79ed73040e1230091a3e0d3d8037699075b6ac58b38198","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T17:47:05Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T17:47:05Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["baac29086d8369ca9c79ed73040e1230091a3e0d3d8037699075b6ac58b38198"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T17:47:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ee3eae7f4f990ad9ad916e25b1634b5713cf96699a46684e4acd478f3fcb0ff2"}
{"level":"info","ts":"2026-07-21T17:47:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"baac29086d8369ca9c79ed73040e1230091a3e0d3d8037699075b6ac58b38198","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:47:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4947733f8c75cb2be93a36747a15df889686c15a18db4494da3a99a80e465a7f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:47:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b84bf956fa6e7b565ba00271da322e0345b06f89df9b58c75e12baf7c761c8b7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:47:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ce9ae44560d24872155b0c11f5bba1a2c9e9ff61413a664817d56dca9260fb39","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:47:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"afb3c8628ab15f2b141d16b8aab7ae18a962158110f58fb5eb52b5a59507307c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:47:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"867845942b8252f5d8d26e1f797c23e0963cc72c48b68848e386d7fdb1b5f718","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:47:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"596067d9605c0f72d97e8a12b26266d2c946aa4f861e9a501fe219fe7a909c25","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:47:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ee3eae7f4f990ad9ad916e25b1634b5713cf96699a46684e4acd478f3fcb0ff2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:47:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"baac29086d8369ca9c79ed73040e1230091a3e0d3d8037699075b6ac58b38198","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-21T17:47:05Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-21T17:47:05Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T17:47:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/baac29086d8369ca9c79ed73040e1230091a3e0d3d8037699075b6ac58b38198"}
{"level":"info","ts":"2026-07-21T17:47:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"baac29086d8369ca9c79ed73040e1230091a3e0d3d8037699075b6ac58b38198","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:47:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"baac29086d8369ca9c79ed73040e1230091a3e0d3d8037699075b6ac58b38198","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T17:47:05Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T17:47:05Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["baac29086d8369ca9c79ed73040e1230091a3e0d3d8037699075b6ac58b38198"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T17:47:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/baac29086d8369ca9c79ed73040e1230091a3e0d3d8037699075b6ac58b38198"}
{"level":"info","ts":"2026-07-21T17:47:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"baac29086d8369ca9c79ed73040e1230091a3e0d3d8037699075b6ac58b38198","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:47:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"baac29086d8369ca9c79ed73040e1230091a3e0d3d8037699075b6ac58b38198","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T17:47:05Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T17:47:05Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["baac29086d8369ca9c79ed73040e1230091a3e0d3d8037699075b6ac58b38198"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T17:47:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/baac29086d8369ca9c79ed73040e1230091a3e0d3d8037699075b6ac58b38198"}
{"level":"error","ts":"2026-07-21T17:47:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"baac29086d8369ca9c79ed73040e1230091a3e0d3d8037699075b6ac58b38198","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"baac29086d8369ca9c79ed73040e1230091a3e0d3d8037699075b6ac58b38198\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-21T17:47:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"baac29086d8369ca9c79ed73040e1230091a3e0d3d8037699075b6ac58b38198","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:47:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"baac29086d8369ca9c79ed73040e1230091a3e0d3d8037699075b6ac58b38198","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-21T17:47:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"05870ff5-fbcc-4ac1-961d-932a01bf0972","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:48766","PortSpecifier":{"PortValue":48766}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.56:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"05870ff5-fbcc-4ac1-961d-932a01bf0972","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-6fedc9.apps.100e5263-5aea-49a1-b78d-4e77e04a47aa.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-21T17:47:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"05870ff5-fbcc-4ac1-961d-932a01bf0972","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:48766","PortSpecifier":{"PortValue":48766}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.56:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784656033,"nanos":160103592},"http":{"id":"05870ff5-fbcc-4ac1-961d-932a01bf0972","method":"POST","headers":{":authority":"e2e-shared-a-6fedc9.apps.100e5263-5aea-49a1-b78d-4e77e04a47aa.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T17:47:13Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"05870ff5-fbcc-4ac1-961d-932a01bf0972","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-21T17:47:13Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"05870ff5-fbcc-4ac1-961d-932a01bf0972","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"d7dff930-8b3e-4866-94c2-35a9f09372f2","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=52378790-3435-4cc3-9ce5-0ef2c2f4ebb3"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4e77e04a47aa"]}}
{"level":"debug","ts":"2026-07-21T17:47:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"05870ff5-fbcc-4ac1-961d-932a01bf0972","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4e77e04a47aa"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=52378790-3435-4cc3-9ce5-0ef2c2f4ebb3"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"d7dff930-8b3e-4866-94c2-35a9f09372f2","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"4947733f8c75cb2be93a36747a15df889686c15a18db4494da3a99a80e465a7f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.56:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-6fedc9.apps.100e5263-5aea-49a1-b78d-4e77e04a47aa.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T17:47:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"05870ff5-fbcc-4ac1-961d-932a01bf0972","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:47:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"05870ff5-fbcc-4ac1-961d-932a01bf0972","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:47:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"05870ff5-fbcc-4ac1-961d-932a01bf0972","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-6fedc9/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:47:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"05870ff5-fbcc-4ac1-961d-932a01bf0972","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-21T17:47:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"05870ff5-fbcc-4ac1-961d-932a01bf0972","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-21T17:47:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"05870ff5-fbcc-4ac1-961d-932a01bf0972","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-21T17:47:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"05870ff5-fbcc-4ac1-961d-932a01bf0972","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-21T17:47:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"05870ff5-fbcc-4ac1-961d-932a01bf0972","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-21T17:47:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8b5be472-b7cb-420f-8edc-b2b8ad74d51c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:60696","PortSpecifier":{"PortValue":60696}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"8b5be472-b7cb-420f-8edc-b2b8ad74d51c","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-5a36a6.apps.100e5263-5aea-49a1-b78d-4e77e04a47aa.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-21T17:47:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8b5be472-b7cb-420f-8edc-b2b8ad74d51c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:60696","PortSpecifier":{"PortValue":60696}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784656033,"nanos":204084069},"http":{"id":"8b5be472-b7cb-420f-8edc-b2b8ad74d51c","method":"POST","headers":{":authority":"e2e-shared-b-5a36a6.apps.100e5263-5aea-49a1-b78d-4e77e04a47aa.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T17:47:13Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"8b5be472-b7cb-420f-8edc-b2b8ad74d51c","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-21T17:47:13Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"8b5be472-b7cb-420f-8edc-b2b8ad74d51c","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"d7dff930-8b3e-4866-94c2-35a9f09372f2","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=52378790-3435-4cc3-9ce5-0ef2c2f4ebb3"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4e77e04a47aa"]}}
{"level":"debug","ts":"2026-07-21T17:47:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"8b5be472-b7cb-420f-8edc-b2b8ad74d51c","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4e77e04a47aa"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=52378790-3435-4cc3-9ce5-0ef2c2f4ebb3"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"d7dff930-8b3e-4866-94c2-35a9f09372f2","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"baac29086d8369ca9c79ed73040e1230091a3e0d3d8037699075b6ac58b38198"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.57:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-5a36a6.apps.100e5263-5aea-49a1-b78d-4e77e04a47aa.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T17:47:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8b5be472-b7cb-420f-8edc-b2b8ad74d51c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:47:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8b5be472-b7cb-420f-8edc-b2b8ad74d51c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:47:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8b5be472-b7cb-420f-8edc-b2b8ad74d51c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-5a36a6/rate-test-model-5a36a6\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-5a36a6/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:47:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"8b5be472-b7cb-420f-8edc-b2b8ad74d51c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-21T17:47:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8b5be472-b7cb-420f-8edc-b2b8ad74d51c","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-21T17:47:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8b5be472-b7cb-420f-8edc-b2b8ad74d51c","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-21T17:47:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8b5be472-b7cb-420f-8edc-b2b8ad74d51c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-21T17:47:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8b5be472-b7cb-420f-8edc-b2b8ad74d51c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-21T17:47:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a69fef36-97f2-4b50-b7a7-d21be049a8ba","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:48782","PortSpecifier":{"PortValue":48782}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.56:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a69fef36-97f2-4b50-b7a7-d21be049a8ba","method":"POST","path":"/ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9/v1/completions","host":"e2e-shared-a-6fedc9.apps.100e5263-5aea-49a1-b78d-4e77e04a47aa.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-21T17:47:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a69fef36-97f2-4b50-b7a7-d21be049a8ba","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:48782","PortSpecifier":{"PortValue":48782}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.56:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784656033,"nanos":243193539},"http":{"id":"a69fef36-97f2-4b50-b7a7-d21be049a8ba","method":"POST","headers":{":authority":"e2e-shared-a-6fedc9.apps.100e5263-5aea-49a1-b78d-4e77e04a47aa.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T17:47:13Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a69fef36-97f2-4b50-b7a7-d21be049a8ba","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-otDtuE05sZQUrMuh_S1OtvxNeoAP9e7KsMrJfLmJRB6yqjNJOgGbJ0bZ3twz"}
{"level":"debug","ts":"2026-07-21T17:47:13Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a69fef36-97f2-4b50-b7a7-d21be049a8ba","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-6fedc9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-otDtuE05sZQUrMuh_S1OtvxNeoAP9e7KsMrJfLmJRB6yqjNJOgGbJ0bZ3twz\"}"}
{"level":"debug","ts":"2026-07-21T17:47:13Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a69fef36-97f2-4b50-b7a7-d21be049a8ba","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-6fedc9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"79be0cea-7a02-4f65-9ec4-79341d2086d3","keyName":"e2e-rate-a-eb650d","subscription":"e2e-rate-iso-a-eb650d","tenant":"e2e-shared-a-6fedc9","userId":"79be0cea-7a02-4f65-9ec4-79341d2086d3","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-21T17:47:13Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a69fef36-97f2-4b50-b7a7-d21be049a8ba","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-6fedc9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9\",\"requestedSubscription\":\"e2e-rate-iso-a-eb650d\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-21T17:47:13Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a69fef36-97f2-4b50-b7a7-d21be049a8ba","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-6fedc9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-6fedc9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-eb650d","namespace":"ai-tenant-e2e-shared-a-6fedc9","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9"}}
{"level":"debug","ts":"2026-07-21T17:47:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a69fef36-97f2-4b50-b7a7-d21be049a8ba","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T17:47:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a69fef36-97f2-4b50-b7a7-d21be049a8ba","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:47:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a69fef36-97f2-4b50-b7a7-d21be049a8ba","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:47:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a69fef36-97f2-4b50-b7a7-d21be049a8ba","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-6fedc9/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:47:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a69fef36-97f2-4b50-b7a7-d21be049a8ba","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:47:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a69fef36-97f2-4b50-b7a7-d21be049a8ba","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-21T17:47:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a69fef36-97f2-4b50-b7a7-d21be049a8ba","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-eb650d"}
{"level":"debug","ts":"2026-07-21T17:47:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a69fef36-97f2-4b50-b7a7-d21be049a8ba","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-21T17:47:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a69fef36-97f2-4b50-b7a7-d21be049a8ba","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"79be0cea-7a02-4f65-9ec4-79341d2086d3","keyName":"e2e-rate-a-eb650d","selected_subscription":"e2e-rate-iso-a-eb650d","selected_subscription_key":"ai-tenant-e2e-shared-a-6fedc9/e2e-rate-iso-a-eb650d@ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-6fedc9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-eb650d","namespace":"ai-tenant-e2e-shared-a-6fedc9","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-21T17:47:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a69fef36-97f2-4b50-b7a7-d21be049a8ba","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-21T17:47:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a69fef36-97f2-4b50-b7a7-d21be049a8ba","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-21T17:47:14Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d1577ace-3a74-4b40-8b3a-1ecc8c26ab5b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:48786","PortSpecifier":{"PortValue":48786}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.56:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d1577ace-3a74-4b40-8b3a-1ecc8c26ab5b","method":"POST","path":"/ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9/v1/completions","host":"e2e-shared-a-6fedc9.apps.100e5263-5aea-49a1-b78d-4e77e04a47aa.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-21T17:47:14Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d1577ace-3a74-4b40-8b3a-1ecc8c26ab5b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:48786","PortSpecifier":{"PortValue":48786}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.56:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784656034,"nanos":294968090},"http":{"id":"d1577ace-3a74-4b40-8b3a-1ecc8c26ab5b","method":"POST","headers":{":authority":"e2e-shared-a-6fedc9.apps.100e5263-5aea-49a1-b78d-4e77e04a47aa.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T17:47:14Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d1577ace-3a74-4b40-8b3a-1ecc8c26ab5b","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-otDtuE05sZQUrMuh_S1OtvxNeoAP9e7KsMrJfLmJRB6yqjNJOgGbJ0bZ3twz"}
{"level":"debug","ts":"2026-07-21T17:47:14Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d1577ace-3a74-4b40-8b3a-1ecc8c26ab5b","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-6fedc9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-otDtuE05sZQUrMuh_S1OtvxNeoAP9e7KsMrJfLmJRB6yqjNJOgGbJ0bZ3twz\"}"}
{"level":"debug","ts":"2026-07-21T17:47:14Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d1577ace-3a74-4b40-8b3a-1ecc8c26ab5b","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-6fedc9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"79be0cea-7a02-4f65-9ec4-79341d2086d3","keyName":"e2e-rate-a-eb650d","subscription":"e2e-rate-iso-a-eb650d","tenant":"e2e-shared-a-6fedc9","userId":"79be0cea-7a02-4f65-9ec4-79341d2086d3","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-21T17:47:14Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d1577ace-3a74-4b40-8b3a-1ecc8c26ab5b","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-6fedc9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9\",\"requestedSubscription\":\"e2e-rate-iso-a-eb650d\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-21T17:47:14Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d1577ace-3a74-4b40-8b3a-1ecc8c26ab5b","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-6fedc9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-6fedc9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-eb650d","namespace":"ai-tenant-e2e-shared-a-6fedc9","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9"}}
{"level":"debug","ts":"2026-07-21T17:47:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d1577ace-3a74-4b40-8b3a-1ecc8c26ab5b","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T17:47:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d1577ace-3a74-4b40-8b3a-1ecc8c26ab5b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:47:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d1577ace-3a74-4b40-8b3a-1ecc8c26ab5b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:47:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d1577ace-3a74-4b40-8b3a-1ecc8c26ab5b","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:47:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d1577ace-3a74-4b40-8b3a-1ecc8c26ab5b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-6fedc9/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:47:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d1577ace-3a74-4b40-8b3a-1ecc8c26ab5b","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-21T17:47:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d1577ace-3a74-4b40-8b3a-1ecc8c26ab5b","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-eb650d"}
{"level":"debug","ts":"2026-07-21T17:47:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d1577ace-3a74-4b40-8b3a-1ecc8c26ab5b","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-21T17:47:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d1577ace-3a74-4b40-8b3a-1ecc8c26ab5b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"79be0cea-7a02-4f65-9ec4-79341d2086d3","keyName":"e2e-rate-a-eb650d","selected_subscription":"e2e-rate-iso-a-eb650d","selected_subscription_key":"ai-tenant-e2e-shared-a-6fedc9/e2e-rate-iso-a-eb650d@ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-6fedc9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-eb650d","namespace":"ai-tenant-e2e-shared-a-6fedc9","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-21T17:47:14Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d1577ace-3a74-4b40-8b3a-1ecc8c26ab5b","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-21T17:47:14Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d1577ace-3a74-4b40-8b3a-1ecc8c26ab5b","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-21T17:47:15Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2ab0ad26-890c-45ee-a00a-546312b5ed51","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:42036","PortSpecifier":{"PortValue":42036}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.56:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2ab0ad26-890c-45ee-a00a-546312b5ed51","method":"POST","path":"/ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9/v1/completions","host":"e2e-shared-a-6fedc9.apps.100e5263-5aea-49a1-b78d-4e77e04a47aa.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-21T17:47:15Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2ab0ad26-890c-45ee-a00a-546312b5ed51","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:42036","PortSpecifier":{"PortValue":42036}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.56:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784656035,"nanos":330783780},"http":{"id":"2ab0ad26-890c-45ee-a00a-546312b5ed51","method":"POST","headers":{":authority":"e2e-shared-a-6fedc9.apps.100e5263-5aea-49a1-b78d-4e77e04a47aa.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T17:47:15Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2ab0ad26-890c-45ee-a00a-546312b5ed51","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-otDtuE05sZQUrMuh_S1OtvxNeoAP9e7KsMrJfLmJRB6yqjNJOgGbJ0bZ3twz"}
{"level":"debug","ts":"2026-07-21T17:47:15Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2ab0ad26-890c-45ee-a00a-546312b5ed51","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-6fedc9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-otDtuE05sZQUrMuh_S1OtvxNeoAP9e7KsMrJfLmJRB6yqjNJOgGbJ0bZ3twz\"}"}
{"level":"debug","ts":"2026-07-21T17:47:15Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2ab0ad26-890c-45ee-a00a-546312b5ed51","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-6fedc9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"79be0cea-7a02-4f65-9ec4-79341d2086d3","keyName":"e2e-rate-a-eb650d","subscription":"e2e-rate-iso-a-eb650d","tenant":"e2e-shared-a-6fedc9","userId":"79be0cea-7a02-4f65-9ec4-79341d2086d3","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-21T17:47:15Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2ab0ad26-890c-45ee-a00a-546312b5ed51","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-6fedc9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9\",\"requestedSubscription\":\"e2e-rate-iso-a-eb650d\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-21T17:47:15Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2ab0ad26-890c-45ee-a00a-546312b5ed51","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-6fedc9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-6fedc9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-eb650d","namespace":"ai-tenant-e2e-shared-a-6fedc9","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9"}}
{"level":"debug","ts":"2026-07-21T17:47:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2ab0ad26-890c-45ee-a00a-546312b5ed51","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T17:47:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2ab0ad26-890c-45ee-a00a-546312b5ed51","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:47:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2ab0ad26-890c-45ee-a00a-546312b5ed51","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:47:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2ab0ad26-890c-45ee-a00a-546312b5ed51","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:47:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2ab0ad26-890c-45ee-a00a-546312b5ed51","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-6fedc9/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:47:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2ab0ad26-890c-45ee-a00a-546312b5ed51","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-21T17:47:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2ab0ad26-890c-45ee-a00a-546312b5ed51","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-eb650d"}
{"level":"debug","ts":"2026-07-21T17:47:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2ab0ad26-890c-45ee-a00a-546312b5ed51","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-21T17:47:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2ab0ad26-890c-45ee-a00a-546312b5ed51","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"79be0cea-7a02-4f65-9ec4-79341d2086d3","keyName":"e2e-rate-a-eb650d","selected_subscription":"e2e-rate-iso-a-eb650d","selected_subscription_key":"ai-tenant-e2e-shared-a-6fedc9/e2e-rate-iso-a-eb650d@ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-6fedc9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-eb650d","namespace":"ai-tenant-e2e-shared-a-6fedc9","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-21T17:47:15Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2ab0ad26-890c-45ee-a00a-546312b5ed51","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-21T17:47:15Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2ab0ad26-890c-45ee-a00a-546312b5ed51","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-21T17:47:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6924d537-a868-4e56-a1e6-ee85322762c4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:42038","PortSpecifier":{"PortValue":42038}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.56:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6924d537-a868-4e56-a1e6-ee85322762c4","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-6fedc9.apps.100e5263-5aea-49a1-b78d-4e77e04a47aa.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-21T17:47:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6924d537-a868-4e56-a1e6-ee85322762c4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:42038","PortSpecifier":{"PortValue":42038}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.56:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784656042,"nanos":21647058},"http":{"id":"6924d537-a868-4e56-a1e6-ee85322762c4","method":"POST","headers":{":authority":"e2e-shared-a-6fedc9.apps.100e5263-5aea-49a1-b78d-4e77e04a47aa.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T17:47:22Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"6924d537-a868-4e56-a1e6-ee85322762c4","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-21T17:47:22Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6924d537-a868-4e56-a1e6-ee85322762c4","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"d7dff930-8b3e-4866-94c2-35a9f09372f2","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=52378790-3435-4cc3-9ce5-0ef2c2f4ebb3"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4e77e04a47aa"]}}
{"level":"debug","ts":"2026-07-21T17:47:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6924d537-a868-4e56-a1e6-ee85322762c4","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4e77e04a47aa"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=52378790-3435-4cc3-9ce5-0ef2c2f4ebb3"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"d7dff930-8b3e-4866-94c2-35a9f09372f2","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"4947733f8c75cb2be93a36747a15df889686c15a18db4494da3a99a80e465a7f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.56:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-6fedc9.apps.100e5263-5aea-49a1-b78d-4e77e04a47aa.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T17:47:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6924d537-a868-4e56-a1e6-ee85322762c4","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:47:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6924d537-a868-4e56-a1e6-ee85322762c4","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:47:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6924d537-a868-4e56-a1e6-ee85322762c4","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-6fedc9/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:47:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"6924d537-a868-4e56-a1e6-ee85322762c4","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-21T17:47:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6924d537-a868-4e56-a1e6-ee85322762c4","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-21T17:47:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6924d537-a868-4e56-a1e6-ee85322762c4","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-21T17:47:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6924d537-a868-4e56-a1e6-ee85322762c4","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-21T17:47:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6924d537-a868-4e56-a1e6-ee85322762c4","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-21T17:47:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cc847923-625f-4c5b-a82d-df5eaaa98440","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:35130","PortSpecifier":{"PortValue":35130}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"cc847923-625f-4c5b-a82d-df5eaaa98440","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-5a36a6.apps.100e5263-5aea-49a1-b78d-4e77e04a47aa.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-21T17:47:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cc847923-625f-4c5b-a82d-df5eaaa98440","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:35130","PortSpecifier":{"PortValue":35130}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784656042,"nanos":57288282},"http":{"id":"cc847923-625f-4c5b-a82d-df5eaaa98440","method":"POST","headers":{":authority":"e2e-shared-b-5a36a6.apps.100e5263-5aea-49a1-b78d-4e77e04a47aa.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T17:47:22Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"cc847923-625f-4c5b-a82d-df5eaaa98440","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-21T17:47:22Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"cc847923-625f-4c5b-a82d-df5eaaa98440","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"d7dff930-8b3e-4866-94c2-35a9f09372f2","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=52378790-3435-4cc3-9ce5-0ef2c2f4ebb3"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4e77e04a47aa"]}}
{"level":"debug","ts":"2026-07-21T17:47:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"cc847923-625f-4c5b-a82d-df5eaaa98440","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4e77e04a47aa"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=52378790-3435-4cc3-9ce5-0ef2c2f4ebb3"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"d7dff930-8b3e-4866-94c2-35a9f09372f2","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"baac29086d8369ca9c79ed73040e1230091a3e0d3d8037699075b6ac58b38198"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.57:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-5a36a6.apps.100e5263-5aea-49a1-b78d-4e77e04a47aa.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T17:47:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cc847923-625f-4c5b-a82d-df5eaaa98440","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:47:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cc847923-625f-4c5b-a82d-df5eaaa98440","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:47:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cc847923-625f-4c5b-a82d-df5eaaa98440","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-5a36a6/rate-test-model-5a36a6\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-5a36a6/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:47:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"cc847923-625f-4c5b-a82d-df5eaaa98440","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-21T17:47:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cc847923-625f-4c5b-a82d-df5eaaa98440","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-21T17:47:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cc847923-625f-4c5b-a82d-df5eaaa98440","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-21T17:47:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cc847923-625f-4c5b-a82d-df5eaaa98440","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-21T17:47:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cc847923-625f-4c5b-a82d-df5eaaa98440","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-21T17:47:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0fe1d15d-dc91-4cfa-9585-95bcb6501895","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:42042","PortSpecifier":{"PortValue":42042}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.56:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0fe1d15d-dc91-4cfa-9585-95bcb6501895","method":"POST","path":"/ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9/v1/completions","host":"e2e-shared-a-6fedc9.apps.100e5263-5aea-49a1-b78d-4e77e04a47aa.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-21T17:47:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0fe1d15d-dc91-4cfa-9585-95bcb6501895","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:42042","PortSpecifier":{"PortValue":42042}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.56:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784656042,"nanos":96186886},"http":{"id":"0fe1d15d-dc91-4cfa-9585-95bcb6501895","method":"POST","headers":{":authority":"e2e-shared-a-6fedc9.apps.100e5263-5aea-49a1-b78d-4e77e04a47aa.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T17:47:22Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0fe1d15d-dc91-4cfa-9585-95bcb6501895","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1CPFbSZ7VxSR3c5Si_iDdhRTulNxZbI4acwVrcALxNLqvYwLg4zf6E1xrKqBG"}
{"level":"debug","ts":"2026-07-21T17:47:22Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0fe1d15d-dc91-4cfa-9585-95bcb6501895","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-6fedc9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1CPFbSZ7VxSR3c5Si_iDdhRTulNxZbI4acwVrcALxNLqvYwLg4zf6E1xrKqBG\"}"}
{"level":"debug","ts":"2026-07-21T17:47:22Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0fe1d15d-dc91-4cfa-9585-95bcb6501895","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-6fedc9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"48edb6eb-8dd9-4eaa-b41c-cb3cec704293","keyName":"e2e-rate-a-128fbe","subscription":"e2e-rate-iso-a-128fbe","tenant":"e2e-shared-a-6fedc9","userId":"48edb6eb-8dd9-4eaa-b41c-cb3cec704293","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-21T17:47:22Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0fe1d15d-dc91-4cfa-9585-95bcb6501895","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-6fedc9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9\",\"requestedSubscription\":\"e2e-rate-iso-a-128fbe\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-21T17:47:22Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0fe1d15d-dc91-4cfa-9585-95bcb6501895","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-6fedc9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-6fedc9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-128fbe","namespace":"ai-tenant-e2e-shared-a-6fedc9","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9"}}
{"level":"debug","ts":"2026-07-21T17:47:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0fe1d15d-dc91-4cfa-9585-95bcb6501895","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T17:47:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0fe1d15d-dc91-4cfa-9585-95bcb6501895","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:47:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0fe1d15d-dc91-4cfa-9585-95bcb6501895","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:47:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0fe1d15d-dc91-4cfa-9585-95bcb6501895","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-6fedc9/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:47:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0fe1d15d-dc91-4cfa-9585-95bcb6501895","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:47:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0fe1d15d-dc91-4cfa-9585-95bcb6501895","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-21T17:47:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0fe1d15d-dc91-4cfa-9585-95bcb6501895","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-128fbe"}
{"level":"debug","ts":"2026-07-21T17:47:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0fe1d15d-dc91-4cfa-9585-95bcb6501895","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-21T17:47:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0fe1d15d-dc91-4cfa-9585-95bcb6501895","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"48edb6eb-8dd9-4eaa-b41c-cb3cec704293","keyName":"e2e-rate-a-128fbe","selected_subscription":"e2e-rate-iso-a-128fbe","selected_subscription_key":"ai-tenant-e2e-shared-a-6fedc9/e2e-rate-iso-a-128fbe@ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-6fedc9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-128fbe","namespace":"ai-tenant-e2e-shared-a-6fedc9","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-21T17:47:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0fe1d15d-dc91-4cfa-9585-95bcb6501895","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-21T17:47:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0fe1d15d-dc91-4cfa-9585-95bcb6501895","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-21T17:47:23Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2cc6c7cc-7c05-4e09-b481-caf80fdf64c9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:42044","PortSpecifier":{"PortValue":42044}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.56:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2cc6c7cc-7c05-4e09-b481-caf80fdf64c9","method":"POST","path":"/ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9/v1/completions","host":"e2e-shared-a-6fedc9.apps.100e5263-5aea-49a1-b78d-4e77e04a47aa.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-21T17:47:23Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2cc6c7cc-7c05-4e09-b481-caf80fdf64c9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:42044","PortSpecifier":{"PortValue":42044}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.56:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784656043,"nanos":130946085},"http":{"id":"2cc6c7cc-7c05-4e09-b481-caf80fdf64c9","method":"POST","headers":{":authority":"e2e-shared-a-6fedc9.apps.100e5263-5aea-49a1-b78d-4e77e04a47aa.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T17:47:23Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2cc6c7cc-7c05-4e09-b481-caf80fdf64c9","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1CPFbSZ7VxSR3c5Si_iDdhRTulNxZbI4acwVrcALxNLqvYwLg4zf6E1xrKqBG"}
{"level":"debug","ts":"2026-07-21T17:47:23Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2cc6c7cc-7c05-4e09-b481-caf80fdf64c9","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-6fedc9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1CPFbSZ7VxSR3c5Si_iDdhRTulNxZbI4acwVrcALxNLqvYwLg4zf6E1xrKqBG\"}"}
{"level":"debug","ts":"2026-07-21T17:47:23Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2cc6c7cc-7c05-4e09-b481-caf80fdf64c9","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-6fedc9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"48edb6eb-8dd9-4eaa-b41c-cb3cec704293","keyName":"e2e-rate-a-128fbe","subscription":"e2e-rate-iso-a-128fbe","tenant":"e2e-shared-a-6fedc9","userId":"48edb6eb-8dd9-4eaa-b41c-cb3cec704293","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-21T17:47:23Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2cc6c7cc-7c05-4e09-b481-caf80fdf64c9","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-6fedc9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9\",\"requestedSubscription\":\"e2e-rate-iso-a-128fbe\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-21T17:47:23Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2cc6c7cc-7c05-4e09-b481-caf80fdf64c9","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-6fedc9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-6fedc9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-128fbe","namespace":"ai-tenant-e2e-shared-a-6fedc9","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9"}}
{"level":"debug","ts":"2026-07-21T17:47:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2cc6c7cc-7c05-4e09-b481-caf80fdf64c9","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T17:47:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2cc6c7cc-7c05-4e09-b481-caf80fdf64c9","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:47:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2cc6c7cc-7c05-4e09-b481-caf80fdf64c9","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:47:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2cc6c7cc-7c05-4e09-b481-caf80fdf64c9","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:47:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2cc6c7cc-7c05-4e09-b481-caf80fdf64c9","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-6fedc9/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:47:23Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2cc6c7cc-7c05-4e09-b481-caf80fdf64c9","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-21T17:47:23Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2cc6c7cc-7c05-4e09-b481-caf80fdf64c9","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-21T17:47:23Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2cc6c7cc-7c05-4e09-b481-caf80fdf64c9","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-128fbe"}
{"level":"debug","ts":"2026-07-21T17:47:23Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2cc6c7cc-7c05-4e09-b481-caf80fdf64c9","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"48edb6eb-8dd9-4eaa-b41c-cb3cec704293","keyName":"e2e-rate-a-128fbe","selected_subscription":"e2e-rate-iso-a-128fbe","selected_subscription_key":"ai-tenant-e2e-shared-a-6fedc9/e2e-rate-iso-a-128fbe@ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-6fedc9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-128fbe","namespace":"ai-tenant-e2e-shared-a-6fedc9","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-21T17:47:23Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2cc6c7cc-7c05-4e09-b481-caf80fdf64c9","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-21T17:47:23Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2cc6c7cc-7c05-4e09-b481-caf80fdf64c9","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-21T17:47:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a66ff5fa-1485-4644-8d23-edeaa3c7cecb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:42048","PortSpecifier":{"PortValue":42048}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.56:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a66ff5fa-1485-4644-8d23-edeaa3c7cecb","method":"POST","path":"/ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9/v1/completions","host":"e2e-shared-a-6fedc9.apps.100e5263-5aea-49a1-b78d-4e77e04a47aa.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-21T17:47:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a66ff5fa-1485-4644-8d23-edeaa3c7cecb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:42048","PortSpecifier":{"PortValue":42048}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.56:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784656044,"nanos":174271319},"http":{"id":"a66ff5fa-1485-4644-8d23-edeaa3c7cecb","method":"POST","headers":{":authority":"e2e-shared-a-6fedc9.apps.100e5263-5aea-49a1-b78d-4e77e04a47aa.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T17:47:24Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a66ff5fa-1485-4644-8d23-edeaa3c7cecb","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1CPFbSZ7VxSR3c5Si_iDdhRTulNxZbI4acwVrcALxNLqvYwLg4zf6E1xrKqBG"}
{"level":"debug","ts":"2026-07-21T17:47:24Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a66ff5fa-1485-4644-8d23-edeaa3c7cecb","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-6fedc9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1CPFbSZ7VxSR3c5Si_iDdhRTulNxZbI4acwVrcALxNLqvYwLg4zf6E1xrKqBG\"}"}
{"level":"debug","ts":"2026-07-21T17:47:24Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a66ff5fa-1485-4644-8d23-edeaa3c7cecb","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-6fedc9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"48edb6eb-8dd9-4eaa-b41c-cb3cec704293","keyName":"e2e-rate-a-128fbe","subscription":"e2e-rate-iso-a-128fbe","tenant":"e2e-shared-a-6fedc9","userId":"48edb6eb-8dd9-4eaa-b41c-cb3cec704293","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-21T17:47:24Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a66ff5fa-1485-4644-8d23-edeaa3c7cecb","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-6fedc9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9\",\"requestedSubscription\":\"e2e-rate-iso-a-128fbe\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-21T17:47:24Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a66ff5fa-1485-4644-8d23-edeaa3c7cecb","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-6fedc9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-6fedc9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-128fbe","namespace":"ai-tenant-e2e-shared-a-6fedc9","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9"}}
{"level":"debug","ts":"2026-07-21T17:47:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a66ff5fa-1485-4644-8d23-edeaa3c7cecb","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T17:47:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a66ff5fa-1485-4644-8d23-edeaa3c7cecb","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:47:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a66ff5fa-1485-4644-8d23-edeaa3c7cecb","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:47:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a66ff5fa-1485-4644-8d23-edeaa3c7cecb","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-6fedc9/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:47:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a66ff5fa-1485-4644-8d23-edeaa3c7cecb","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:47:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a66ff5fa-1485-4644-8d23-edeaa3c7cecb","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-21T17:47:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a66ff5fa-1485-4644-8d23-edeaa3c7cecb","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-21T17:47:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a66ff5fa-1485-4644-8d23-edeaa3c7cecb","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-128fbe"}
{"level":"debug","ts":"2026-07-21T17:47:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a66ff5fa-1485-4644-8d23-edeaa3c7cecb","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"48edb6eb-8dd9-4eaa-b41c-cb3cec704293","keyName":"e2e-rate-a-128fbe","selected_subscription":"e2e-rate-iso-a-128fbe","selected_subscription_key":"ai-tenant-e2e-shared-a-6fedc9/e2e-rate-iso-a-128fbe@ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-6fedc9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-128fbe","namespace":"ai-tenant-e2e-shared-a-6fedc9","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-21T17:47:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a66ff5fa-1485-4644-8d23-edeaa3c7cecb","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-21T17:47:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a66ff5fa-1485-4644-8d23-edeaa3c7cecb","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-21T17:47:25Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8b2ff7be-13d7-4fe0-bec6-be26a78fa155","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:59028","PortSpecifier":{"PortValue":59028}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.56:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"8b2ff7be-13d7-4fe0-bec6-be26a78fa155","method":"POST","path":"/ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9/v1/completions","host":"e2e-shared-a-6fedc9.apps.100e5263-5aea-49a1-b78d-4e77e04a47aa.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-21T17:47:25Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8b2ff7be-13d7-4fe0-bec6-be26a78fa155","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:59028","PortSpecifier":{"PortValue":59028}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.56:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784656045,"nanos":207911583},"http":{"id":"8b2ff7be-13d7-4fe0-bec6-be26a78fa155","method":"POST","headers":{":authority":"e2e-shared-a-6fedc9.apps.100e5263-5aea-49a1-b78d-4e77e04a47aa.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T17:47:25Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"8b2ff7be-13d7-4fe0-bec6-be26a78fa155","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1CPFbSZ7VxSR3c5Si_iDdhRTulNxZbI4acwVrcALxNLqvYwLg4zf6E1xrKqBG"}
{"level":"debug","ts":"2026-07-21T17:47:25Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"8b2ff7be-13d7-4fe0-bec6-be26a78fa155","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-6fedc9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1CPFbSZ7VxSR3c5Si_iDdhRTulNxZbI4acwVrcALxNLqvYwLg4zf6E1xrKqBG\"}"}
{"level":"debug","ts":"2026-07-21T17:47:25Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"8b2ff7be-13d7-4fe0-bec6-be26a78fa155","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-6fedc9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"48edb6eb-8dd9-4eaa-b41c-cb3cec704293","keyName":"e2e-rate-a-128fbe","subscription":"e2e-rate-iso-a-128fbe","tenant":"e2e-shared-a-6fedc9","userId":"48edb6eb-8dd9-4eaa-b41c-cb3cec704293","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-21T17:47:25Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"8b2ff7be-13d7-4fe0-bec6-be26a78fa155","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-6fedc9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9\",\"requestedSubscription\":\"e2e-rate-iso-a-128fbe\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-21T17:47:25Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"8b2ff7be-13d7-4fe0-bec6-be26a78fa155","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-6fedc9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-6fedc9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-128fbe","namespace":"ai-tenant-e2e-shared-a-6fedc9","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9"}}
{"level":"debug","ts":"2026-07-21T17:47:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"8b2ff7be-13d7-4fe0-bec6-be26a78fa155","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T17:47:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8b2ff7be-13d7-4fe0-bec6-be26a78fa155","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:47:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8b2ff7be-13d7-4fe0-bec6-be26a78fa155","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:47:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8b2ff7be-13d7-4fe0-bec6-be26a78fa155","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:47:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8b2ff7be-13d7-4fe0-bec6-be26a78fa155","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-6fedc9/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:47:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8b2ff7be-13d7-4fe0-bec6-be26a78fa155","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-21T17:47:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8b2ff7be-13d7-4fe0-bec6-be26a78fa155","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-128fbe"}
{"level":"debug","ts":"2026-07-21T17:47:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8b2ff7be-13d7-4fe0-bec6-be26a78fa155","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-21T17:47:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8b2ff7be-13d7-4fe0-bec6-be26a78fa155","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"48edb6eb-8dd9-4eaa-b41c-cb3cec704293","keyName":"e2e-rate-a-128fbe","selected_subscription":"e2e-rate-iso-a-128fbe","selected_subscription_key":"ai-tenant-e2e-shared-a-6fedc9/e2e-rate-iso-a-128fbe@ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-6fedc9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-128fbe","namespace":"ai-tenant-e2e-shared-a-6fedc9","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-21T17:47:25Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8b2ff7be-13d7-4fe0-bec6-be26a78fa155","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-21T17:47:25Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8b2ff7be-13d7-4fe0-bec6-be26a78fa155","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-21T17:47:26Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"53ebd162-2819-4e39-9228-5afcbfd5a41e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:59044","PortSpecifier":{"PortValue":59044}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.56:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"53ebd162-2819-4e39-9228-5afcbfd5a41e","method":"POST","path":"/ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9/v1/completions","host":"e2e-shared-a-6fedc9.apps.100e5263-5aea-49a1-b78d-4e77e04a47aa.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-21T17:47:26Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"53ebd162-2819-4e39-9228-5afcbfd5a41e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:59044","PortSpecifier":{"PortValue":59044}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.56:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784656046,"nanos":246486967},"http":{"id":"53ebd162-2819-4e39-9228-5afcbfd5a41e","method":"POST","headers":{":authority":"e2e-shared-a-6fedc9.apps.100e5263-5aea-49a1-b78d-4e77e04a47aa.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T17:47:26Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"53ebd162-2819-4e39-9228-5afcbfd5a41e","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1CPFbSZ7VxSR3c5Si_iDdhRTulNxZbI4acwVrcALxNLqvYwLg4zf6E1xrKqBG"}
{"level":"debug","ts":"2026-07-21T17:47:26Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"53ebd162-2819-4e39-9228-5afcbfd5a41e","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-6fedc9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1CPFbSZ7VxSR3c5Si_iDdhRTulNxZbI4acwVrcALxNLqvYwLg4zf6E1xrKqBG\"}"}
{"level":"debug","ts":"2026-07-21T17:47:26Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"53ebd162-2819-4e39-9228-5afcbfd5a41e","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-6fedc9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"48edb6eb-8dd9-4eaa-b41c-cb3cec704293","keyName":"e2e-rate-a-128fbe","subscription":"e2e-rate-iso-a-128fbe","tenant":"e2e-shared-a-6fedc9","userId":"48edb6eb-8dd9-4eaa-b41c-cb3cec704293","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-21T17:47:26Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"53ebd162-2819-4e39-9228-5afcbfd5a41e","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-6fedc9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9\",\"requestedSubscription\":\"e2e-rate-iso-a-128fbe\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-21T17:47:26Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"53ebd162-2819-4e39-9228-5afcbfd5a41e","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-6fedc9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-6fedc9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-128fbe","namespace":"ai-tenant-e2e-shared-a-6fedc9","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9"}}
{"level":"debug","ts":"2026-07-21T17:47:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"53ebd162-2819-4e39-9228-5afcbfd5a41e","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T17:47:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"53ebd162-2819-4e39-9228-5afcbfd5a41e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:47:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"53ebd162-2819-4e39-9228-5afcbfd5a41e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:47:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"53ebd162-2819-4e39-9228-5afcbfd5a41e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-6fedc9/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:47:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"53ebd162-2819-4e39-9228-5afcbfd5a41e","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:47:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"53ebd162-2819-4e39-9228-5afcbfd5a41e","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-21T17:47:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"53ebd162-2819-4e39-9228-5afcbfd5a41e","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-128fbe"}
{"level":"debug","ts":"2026-07-21T17:47:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"53ebd162-2819-4e39-9228-5afcbfd5a41e","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-21T17:47:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"53ebd162-2819-4e39-9228-5afcbfd5a41e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"48edb6eb-8dd9-4eaa-b41c-cb3cec704293","keyName":"e2e-rate-a-128fbe","selected_subscription":"e2e-rate-iso-a-128fbe","selected_subscription_key":"ai-tenant-e2e-shared-a-6fedc9/e2e-rate-iso-a-128fbe@ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-6fedc9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-128fbe","namespace":"ai-tenant-e2e-shared-a-6fedc9","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-21T17:47:26Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"53ebd162-2819-4e39-9228-5afcbfd5a41e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-21T17:47:26Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"53ebd162-2819-4e39-9228-5afcbfd5a41e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-21T17:47:27Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"48b0bc89-f0bf-4265-8b0c-55a6a7787a83","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:59054","PortSpecifier":{"PortValue":59054}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.56:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"48b0bc89-f0bf-4265-8b0c-55a6a7787a83","method":"POST","path":"/ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9/v1/completions","host":"e2e-shared-a-6fedc9.apps.100e5263-5aea-49a1-b78d-4e77e04a47aa.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-21T17:47:27Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"48b0bc89-f0bf-4265-8b0c-55a6a7787a83","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:59054","PortSpecifier":{"PortValue":59054}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.56:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784656047,"nanos":281450578},"http":{"id":"48b0bc89-f0bf-4265-8b0c-55a6a7787a83","method":"POST","headers":{":authority":"e2e-shared-a-6fedc9.apps.100e5263-5aea-49a1-b78d-4e77e04a47aa.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T17:47:27Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"48b0bc89-f0bf-4265-8b0c-55a6a7787a83","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1CPFbSZ7VxSR3c5Si_iDdhRTulNxZbI4acwVrcALxNLqvYwLg4zf6E1xrKqBG"}
{"level":"debug","ts":"2026-07-21T17:47:27Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"48b0bc89-f0bf-4265-8b0c-55a6a7787a83","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-6fedc9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1CPFbSZ7VxSR3c5Si_iDdhRTulNxZbI4acwVrcALxNLqvYwLg4zf6E1xrKqBG\"}"}
{"level":"debug","ts":"2026-07-21T17:47:27Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"48b0bc89-f0bf-4265-8b0c-55a6a7787a83","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-6fedc9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"48edb6eb-8dd9-4eaa-b41c-cb3cec704293","keyName":"e2e-rate-a-128fbe","subscription":"e2e-rate-iso-a-128fbe","tenant":"e2e-shared-a-6fedc9","userId":"48edb6eb-8dd9-4eaa-b41c-cb3cec704293","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-21T17:47:27Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"48b0bc89-f0bf-4265-8b0c-55a6a7787a83","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-6fedc9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9\",\"requestedSubscription\":\"e2e-rate-iso-a-128fbe\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-21T17:47:27Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"48b0bc89-f0bf-4265-8b0c-55a6a7787a83","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-6fedc9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-6fedc9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-128fbe","namespace":"ai-tenant-e2e-shared-a-6fedc9","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9"}}
{"level":"debug","ts":"2026-07-21T17:47:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"48b0bc89-f0bf-4265-8b0c-55a6a7787a83","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T17:47:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"48b0bc89-f0bf-4265-8b0c-55a6a7787a83","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:47:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"48b0bc89-f0bf-4265-8b0c-55a6a7787a83","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:47:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"48b0bc89-f0bf-4265-8b0c-55a6a7787a83","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-6fedc9/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:47:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"48b0bc89-f0bf-4265-8b0c-55a6a7787a83","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:47:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"48b0bc89-f0bf-4265-8b0c-55a6a7787a83","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-21T17:47:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"48b0bc89-f0bf-4265-8b0c-55a6a7787a83","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-128fbe"}
{"level":"debug","ts":"2026-07-21T17:47:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"48b0bc89-f0bf-4265-8b0c-55a6a7787a83","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-21T17:47:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"48b0bc89-f0bf-4265-8b0c-55a6a7787a83","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"48edb6eb-8dd9-4eaa-b41c-cb3cec704293","keyName":"e2e-rate-a-128fbe","selected_subscription":"e2e-rate-iso-a-128fbe","selected_subscription_key":"ai-tenant-e2e-shared-a-6fedc9/e2e-rate-iso-a-128fbe@ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-6fedc9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-128fbe","namespace":"ai-tenant-e2e-shared-a-6fedc9","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-21T17:47:27Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"48b0bc89-f0bf-4265-8b0c-55a6a7787a83","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-21T17:47:27Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"48b0bc89-f0bf-4265-8b0c-55a6a7787a83","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-21T17:47:28Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"836a73f4-4c8b-437d-881c-396c75d64193","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:59066","PortSpecifier":{"PortValue":59066}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.56:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"836a73f4-4c8b-437d-881c-396c75d64193","method":"POST","path":"/ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9/v1/completions","host":"e2e-shared-a-6fedc9.apps.100e5263-5aea-49a1-b78d-4e77e04a47aa.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-21T17:47:28Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"836a73f4-4c8b-437d-881c-396c75d64193","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:59066","PortSpecifier":{"PortValue":59066}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.56:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784656048,"nanos":315256544},"http":{"id":"836a73f4-4c8b-437d-881c-396c75d64193","method":"POST","headers":{":authority":"e2e-shared-a-6fedc9.apps.100e5263-5aea-49a1-b78d-4e77e04a47aa.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T17:47:28Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"836a73f4-4c8b-437d-881c-396c75d64193","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1CPFbSZ7VxSR3c5Si_iDdhRTulNxZbI4acwVrcALxNLqvYwLg4zf6E1xrKqBG"}
{"level":"debug","ts":"2026-07-21T17:47:28Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"836a73f4-4c8b-437d-881c-396c75d64193","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-6fedc9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1CPFbSZ7VxSR3c5Si_iDdhRTulNxZbI4acwVrcALxNLqvYwLg4zf6E1xrKqBG\"}"}
{"level":"debug","ts":"2026-07-21T17:47:28Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"836a73f4-4c8b-437d-881c-396c75d64193","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-6fedc9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"48edb6eb-8dd9-4eaa-b41c-cb3cec704293","keyName":"e2e-rate-a-128fbe","subscription":"e2e-rate-iso-a-128fbe","tenant":"e2e-shared-a-6fedc9","userId":"48edb6eb-8dd9-4eaa-b41c-cb3cec704293","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-21T17:47:28Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"836a73f4-4c8b-437d-881c-396c75d64193","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-6fedc9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9\",\"requestedSubscription\":\"e2e-rate-iso-a-128fbe\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-21T17:47:28Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"836a73f4-4c8b-437d-881c-396c75d64193","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-6fedc9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-6fedc9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-128fbe","namespace":"ai-tenant-e2e-shared-a-6fedc9","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9"}}
{"level":"debug","ts":"2026-07-21T17:47:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"836a73f4-4c8b-437d-881c-396c75d64193","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T17:47:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"836a73f4-4c8b-437d-881c-396c75d64193","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:47:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"836a73f4-4c8b-437d-881c-396c75d64193","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:47:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"836a73f4-4c8b-437d-881c-396c75d64193","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-6fedc9/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:47:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"836a73f4-4c8b-437d-881c-396c75d64193","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:47:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"836a73f4-4c8b-437d-881c-396c75d64193","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-21T17:47:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"836a73f4-4c8b-437d-881c-396c75d64193","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-128fbe"}
{"level":"debug","ts":"2026-07-21T17:47:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"836a73f4-4c8b-437d-881c-396c75d64193","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-21T17:47:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"836a73f4-4c8b-437d-881c-396c75d64193","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"48edb6eb-8dd9-4eaa-b41c-cb3cec704293","keyName":"e2e-rate-a-128fbe","selected_subscription":"e2e-rate-iso-a-128fbe","selected_subscription_key":"ai-tenant-e2e-shared-a-6fedc9/e2e-rate-iso-a-128fbe@ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-6fedc9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-128fbe","namespace":"ai-tenant-e2e-shared-a-6fedc9","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-21T17:47:28Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"836a73f4-4c8b-437d-881c-396c75d64193","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-21T17:47:28Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"836a73f4-4c8b-437d-881c-396c75d64193","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-21T17:47:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2183a930-d675-41c5-9c9a-f4b0c6d25709","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:59078","PortSpecifier":{"PortValue":59078}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.56:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2183a930-d675-41c5-9c9a-f4b0c6d25709","method":"POST","path":"/ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9/v1/completions","host":"e2e-shared-a-6fedc9.apps.100e5263-5aea-49a1-b78d-4e77e04a47aa.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-21T17:47:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2183a930-d675-41c5-9c9a-f4b0c6d25709","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:59078","PortSpecifier":{"PortValue":59078}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.56:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784656049,"nanos":351343643},"http":{"id":"2183a930-d675-41c5-9c9a-f4b0c6d25709","method":"POST","headers":{":authority":"e2e-shared-a-6fedc9.apps.100e5263-5aea-49a1-b78d-4e77e04a47aa.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T17:47:29Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2183a930-d675-41c5-9c9a-f4b0c6d25709","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1CPFbSZ7VxSR3c5Si_iDdhRTulNxZbI4acwVrcALxNLqvYwLg4zf6E1xrKqBG"}
{"level":"debug","ts":"2026-07-21T17:47:29Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2183a930-d675-41c5-9c9a-f4b0c6d25709","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-6fedc9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1CPFbSZ7VxSR3c5Si_iDdhRTulNxZbI4acwVrcALxNLqvYwLg4zf6E1xrKqBG\"}"}
{"level":"debug","ts":"2026-07-21T17:47:29Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2183a930-d675-41c5-9c9a-f4b0c6d25709","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-6fedc9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"48edb6eb-8dd9-4eaa-b41c-cb3cec704293","keyName":"e2e-rate-a-128fbe","subscription":"e2e-rate-iso-a-128fbe","tenant":"e2e-shared-a-6fedc9","userId":"48edb6eb-8dd9-4eaa-b41c-cb3cec704293","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-21T17:47:29Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2183a930-d675-41c5-9c9a-f4b0c6d25709","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-6fedc9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9\",\"requestedSubscription\":\"e2e-rate-iso-a-128fbe\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-21T17:47:29Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2183a930-d675-41c5-9c9a-f4b0c6d25709","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-6fedc9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-6fedc9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-128fbe","namespace":"ai-tenant-e2e-shared-a-6fedc9","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9"}}
{"level":"debug","ts":"2026-07-21T17:47:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2183a930-d675-41c5-9c9a-f4b0c6d25709","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T17:47:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2183a930-d675-41c5-9c9a-f4b0c6d25709","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:47:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2183a930-d675-41c5-9c9a-f4b0c6d25709","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:47:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2183a930-d675-41c5-9c9a-f4b0c6d25709","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-6fedc9/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:47:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2183a930-d675-41c5-9c9a-f4b0c6d25709","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:47:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2183a930-d675-41c5-9c9a-f4b0c6d25709","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-21T17:47:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2183a930-d675-41c5-9c9a-f4b0c6d25709","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-128fbe"}
{"level":"debug","ts":"2026-07-21T17:47:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2183a930-d675-41c5-9c9a-f4b0c6d25709","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-21T17:47:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2183a930-d675-41c5-9c9a-f4b0c6d25709","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"48edb6eb-8dd9-4eaa-b41c-cb3cec704293","keyName":"e2e-rate-a-128fbe","selected_subscription":"e2e-rate-iso-a-128fbe","selected_subscription_key":"ai-tenant-e2e-shared-a-6fedc9/e2e-rate-iso-a-128fbe@ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-6fedc9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-128fbe","namespace":"ai-tenant-e2e-shared-a-6fedc9","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-21T17:47:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2183a930-d675-41c5-9c9a-f4b0c6d25709","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-21T17:47:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2183a930-d675-41c5-9c9a-f4b0c6d25709","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-21T17:47:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"32dc0b52-80b8-4f3e-bd34-120a6e5a5cc3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:59088","PortSpecifier":{"PortValue":59088}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.56:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"32dc0b52-80b8-4f3e-bd34-120a6e5a5cc3","method":"POST","path":"/ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9/v1/completions","host":"e2e-shared-a-6fedc9.apps.100e5263-5aea-49a1-b78d-4e77e04a47aa.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-21T17:47:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"32dc0b52-80b8-4f3e-bd34-120a6e5a5cc3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:59088","PortSpecifier":{"PortValue":59088}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.56:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784656050,"nanos":384643930},"http":{"id":"32dc0b52-80b8-4f3e-bd34-120a6e5a5cc3","method":"POST","headers":{":authority":"e2e-shared-a-6fedc9.apps.100e5263-5aea-49a1-b78d-4e77e04a47aa.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T17:47:30Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"32dc0b52-80b8-4f3e-bd34-120a6e5a5cc3","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1CPFbSZ7VxSR3c5Si_iDdhRTulNxZbI4acwVrcALxNLqvYwLg4zf6E1xrKqBG"}
{"level":"debug","ts":"2026-07-21T17:47:30Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"32dc0b52-80b8-4f3e-bd34-120a6e5a5cc3","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-6fedc9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1CPFbSZ7VxSR3c5Si_iDdhRTulNxZbI4acwVrcALxNLqvYwLg4zf6E1xrKqBG\"}"}
{"level":"debug","ts":"2026-07-21T17:47:30Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"32dc0b52-80b8-4f3e-bd34-120a6e5a5cc3","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-6fedc9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"48edb6eb-8dd9-4eaa-b41c-cb3cec704293","keyName":"e2e-rate-a-128fbe","subscription":"e2e-rate-iso-a-128fbe","tenant":"e2e-shared-a-6fedc9","userId":"48edb6eb-8dd9-4eaa-b41c-cb3cec704293","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-21T17:47:30Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"32dc0b52-80b8-4f3e-bd34-120a6e5a5cc3","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-6fedc9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9\",\"requestedSubscription\":\"e2e-rate-iso-a-128fbe\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-21T17:47:30Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"32dc0b52-80b8-4f3e-bd34-120a6e5a5cc3","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-6fedc9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-6fedc9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-128fbe","namespace":"ai-tenant-e2e-shared-a-6fedc9","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9"}}
{"level":"debug","ts":"2026-07-21T17:47:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"32dc0b52-80b8-4f3e-bd34-120a6e5a5cc3","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T17:47:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"32dc0b52-80b8-4f3e-bd34-120a6e5a5cc3","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:47:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"32dc0b52-80b8-4f3e-bd34-120a6e5a5cc3","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:47:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"32dc0b52-80b8-4f3e-bd34-120a6e5a5cc3","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-6fedc9/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:47:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"32dc0b52-80b8-4f3e-bd34-120a6e5a5cc3","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:47:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"32dc0b52-80b8-4f3e-bd34-120a6e5a5cc3","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-21T17:47:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"32dc0b52-80b8-4f3e-bd34-120a6e5a5cc3","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-128fbe"}
{"level":"debug","ts":"2026-07-21T17:47:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"32dc0b52-80b8-4f3e-bd34-120a6e5a5cc3","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-21T17:47:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"32dc0b52-80b8-4f3e-bd34-120a6e5a5cc3","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"48edb6eb-8dd9-4eaa-b41c-cb3cec704293","keyName":"e2e-rate-a-128fbe","selected_subscription":"e2e-rate-iso-a-128fbe","selected_subscription_key":"ai-tenant-e2e-shared-a-6fedc9/e2e-rate-iso-a-128fbe@ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-6fedc9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-128fbe","namespace":"ai-tenant-e2e-shared-a-6fedc9","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-21T17:47:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"32dc0b52-80b8-4f3e-bd34-120a6e5a5cc3","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-21T17:47:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"32dc0b52-80b8-4f3e-bd34-120a6e5a5cc3","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-21T17:47:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8ce1fb9a-77fc-445a-aa54-f7b054a405cb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:59096","PortSpecifier":{"PortValue":59096}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.56:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"8ce1fb9a-77fc-445a-aa54-f7b054a405cb","method":"POST","path":"/ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9/v1/completions","host":"e2e-shared-a-6fedc9.apps.100e5263-5aea-49a1-b78d-4e77e04a47aa.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-21T17:47:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8ce1fb9a-77fc-445a-aa54-f7b054a405cb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:59096","PortSpecifier":{"PortValue":59096}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.56:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784656051,"nanos":423754316},"http":{"id":"8ce1fb9a-77fc-445a-aa54-f7b054a405cb","method":"POST","headers":{":authority":"e2e-shared-a-6fedc9.apps.100e5263-5aea-49a1-b78d-4e77e04a47aa.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T17:47:31Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"8ce1fb9a-77fc-445a-aa54-f7b054a405cb","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1CPFbSZ7VxSR3c5Si_iDdhRTulNxZbI4acwVrcALxNLqvYwLg4zf6E1xrKqBG"}
{"level":"debug","ts":"2026-07-21T17:47:31Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"8ce1fb9a-77fc-445a-aa54-f7b054a405cb","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-6fedc9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1CPFbSZ7VxSR3c5Si_iDdhRTulNxZbI4acwVrcALxNLqvYwLg4zf6E1xrKqBG\"}"}
{"level":"debug","ts":"2026-07-21T17:47:31Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"8ce1fb9a-77fc-445a-aa54-f7b054a405cb","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-6fedc9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"48edb6eb-8dd9-4eaa-b41c-cb3cec704293","keyName":"e2e-rate-a-128fbe","subscription":"e2e-rate-iso-a-128fbe","tenant":"e2e-shared-a-6fedc9","userId":"48edb6eb-8dd9-4eaa-b41c-cb3cec704293","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-21T17:47:31Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"8ce1fb9a-77fc-445a-aa54-f7b054a405cb","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-6fedc9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9\",\"requestedSubscription\":\"e2e-rate-iso-a-128fbe\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-21T17:47:31Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"8ce1fb9a-77fc-445a-aa54-f7b054a405cb","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-6fedc9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-6fedc9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-128fbe","namespace":"ai-tenant-e2e-shared-a-6fedc9","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9"}}
{"level":"debug","ts":"2026-07-21T17:47:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"8ce1fb9a-77fc-445a-aa54-f7b054a405cb","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T17:47:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8ce1fb9a-77fc-445a-aa54-f7b054a405cb","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:47:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8ce1fb9a-77fc-445a-aa54-f7b054a405cb","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:47:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8ce1fb9a-77fc-445a-aa54-f7b054a405cb","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:47:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8ce1fb9a-77fc-445a-aa54-f7b054a405cb","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-6fedc9/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:47:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8ce1fb9a-77fc-445a-aa54-f7b054a405cb","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-128fbe"}
{"level":"debug","ts":"2026-07-21T17:47:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8ce1fb9a-77fc-445a-aa54-f7b054a405cb","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-21T17:47:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8ce1fb9a-77fc-445a-aa54-f7b054a405cb","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-21T17:47:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8ce1fb9a-77fc-445a-aa54-f7b054a405cb","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"48edb6eb-8dd9-4eaa-b41c-cb3cec704293","keyName":"e2e-rate-a-128fbe","selected_subscription":"e2e-rate-iso-a-128fbe","selected_subscription_key":"ai-tenant-e2e-shared-a-6fedc9/e2e-rate-iso-a-128fbe@ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-6fedc9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-128fbe","namespace":"ai-tenant-e2e-shared-a-6fedc9","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-21T17:47:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8ce1fb9a-77fc-445a-aa54-f7b054a405cb","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-21T17:47:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8ce1fb9a-77fc-445a-aa54-f7b054a405cb","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-21T17:47:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9ab3459e-740f-9ff0-8c3f-9065f732c84f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:59112","PortSpecifier":{"PortValue":59112}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.56:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9ab3459e-740f-9ff0-8c3f-9065f732c84f","method":"POST","path":"/ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9/v1/completions","host":"e2e-shared-a-6fedc9.apps.100e5263-5aea-49a1-b78d-4e77e04a47aa.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-21T17:47:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9ab3459e-740f-9ff0-8c3f-9065f732c84f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:59112","PortSpecifier":{"PortValue":59112}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.56:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784656052,"nanos":461072012},"http":{"id":"9ab3459e-740f-9ff0-8c3f-9065f732c84f","method":"POST","headers":{":authority":"e2e-shared-a-6fedc9.apps.100e5263-5aea-49a1-b78d-4e77e04a47aa.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T17:47:32Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9ab3459e-740f-9ff0-8c3f-9065f732c84f","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1CPFbSZ7VxSR3c5Si_iDdhRTulNxZbI4acwVrcALxNLqvYwLg4zf6E1xrKqBG"}
{"level":"debug","ts":"2026-07-21T17:47:32Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9ab3459e-740f-9ff0-8c3f-9065f732c84f","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-6fedc9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1CPFbSZ7VxSR3c5Si_iDdhRTulNxZbI4acwVrcALxNLqvYwLg4zf6E1xrKqBG\"}"}
{"level":"debug","ts":"2026-07-21T17:47:32Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9ab3459e-740f-9ff0-8c3f-9065f732c84f","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-6fedc9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"48edb6eb-8dd9-4eaa-b41c-cb3cec704293","keyName":"e2e-rate-a-128fbe","subscription":"e2e-rate-iso-a-128fbe","tenant":"e2e-shared-a-6fedc9","userId":"48edb6eb-8dd9-4eaa-b41c-cb3cec704293","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-21T17:47:32Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9ab3459e-740f-9ff0-8c3f-9065f732c84f","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-6fedc9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9\",\"requestedSubscription\":\"e2e-rate-iso-a-128fbe\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-21T17:47:32Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9ab3459e-740f-9ff0-8c3f-9065f732c84f","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-6fedc9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-6fedc9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-128fbe","namespace":"ai-tenant-e2e-shared-a-6fedc9","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9"}}
{"level":"debug","ts":"2026-07-21T17:47:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9ab3459e-740f-9ff0-8c3f-9065f732c84f","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T17:47:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9ab3459e-740f-9ff0-8c3f-9065f732c84f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:47:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9ab3459e-740f-9ff0-8c3f-9065f732c84f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:47:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9ab3459e-740f-9ff0-8c3f-9065f732c84f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-6fedc9/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:47:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9ab3459e-740f-9ff0-8c3f-9065f732c84f","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:47:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9ab3459e-740f-9ff0-8c3f-9065f732c84f","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-21T17:47:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9ab3459e-740f-9ff0-8c3f-9065f732c84f","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-21T17:47:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9ab3459e-740f-9ff0-8c3f-9065f732c84f","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-128fbe"}
{"level":"debug","ts":"2026-07-21T17:47:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9ab3459e-740f-9ff0-8c3f-9065f732c84f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"48edb6eb-8dd9-4eaa-b41c-cb3cec704293","keyName":"e2e-rate-a-128fbe","selected_subscription":"e2e-rate-iso-a-128fbe","selected_subscription_key":"ai-tenant-e2e-shared-a-6fedc9/e2e-rate-iso-a-128fbe@ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-6fedc9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-128fbe","namespace":"ai-tenant-e2e-shared-a-6fedc9","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-6fedc9/rate-test-model-6fedc9"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-21T17:47:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9ab3459e-740f-9ff0-8c3f-9065f732c84f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-21T17:47:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9ab3459e-740f-9ff0-8c3f-9065f732c84f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-21T17:47:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d9dd60d1-2394-41bb-bb87-530cc7778542","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:46194","PortSpecifier":{"PortValue":46194}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d9dd60d1-2394-41bb-bb87-530cc7778542","method":"POST","path":"/ai-tenant-e2e-shared-b-5a36a6/rate-test-model-5a36a6/v1/completions","host":"e2e-shared-b-5a36a6.apps.100e5263-5aea-49a1-b78d-4e77e04a47aa.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-21T17:47:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d9dd60d1-2394-41bb-bb87-530cc7778542","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:46194","PortSpecifier":{"PortValue":46194}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784656052,"nanos":496764866},"http":{"id":"d9dd60d1-2394-41bb-bb87-530cc7778542","method":"POST","headers":{":authority":"e2e-shared-b-5a36a6.apps.100e5263-5aea-49a1-b78d-4e77e04a47aa.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-5a36a6/rate-test-model-5a36a6/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T17:47:32Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d9dd60d1-2394-41bb-bb87-530cc7778542","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-120Pm3NjmkLG4VJnj_vyMYjUF4h743ZjnJDOZR3vFMcfSdouUU4rpPSfYULQl"}
{"level":"debug","ts":"2026-07-21T17:47:32Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d9dd60d1-2394-41bb-bb87-530cc7778542","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-5a36a6.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-120Pm3NjmkLG4VJnj_vyMYjUF4h743ZjnJDOZR3vFMcfSdouUU4rpPSfYULQl\"}"}
{"level":"debug","ts":"2026-07-21T17:47:32Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d9dd60d1-2394-41bb-bb87-530cc7778542","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-5a36a6.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"1ba54639-d042-44ac-817d-31297e950a5f","keyName":"e2e-rate-b-128fbe","subscription":"e2e-rate-iso-b-128fbe","tenant":"e2e-shared-b-5a36a6","userId":"1ba54639-d042-44ac-817d-31297e950a5f","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-21T17:47:32Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d9dd60d1-2394-41bb-bb87-530cc7778542","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-5a36a6.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-5a36a6/rate-test-model-5a36a6\",\"requestedSubscription\":\"e2e-rate-iso-b-128fbe\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-21T17:47:32Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d9dd60d1-2394-41bb-bb87-530cc7778542","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-5a36a6.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-5a36a6","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-128fbe","namespace":"ai-tenant-e2e-shared-b-5a36a6","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-b-5a36a6/rate-test-model-5a36a6"}}
{"level":"debug","ts":"2026-07-21T17:47:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d9dd60d1-2394-41bb-bb87-530cc7778542","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T17:47:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d9dd60d1-2394-41bb-bb87-530cc7778542","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:47:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d9dd60d1-2394-41bb-bb87-530cc7778542","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:47:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d9dd60d1-2394-41bb-bb87-530cc7778542","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-5a36a6/rate-test-model-5a36a6\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-5a36a6/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:47:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d9dd60d1-2394-41bb-bb87-530cc7778542","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:47:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d9dd60d1-2394-41bb-bb87-530cc7778542","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-21T17:47:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d9dd60d1-2394-41bb-bb87-530cc7778542","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-21T17:47:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d9dd60d1-2394-41bb-bb87-530cc7778542","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-128fbe"}
{"level":"debug","ts":"2026-07-21T17:47:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d9dd60d1-2394-41bb-bb87-530cc7778542","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"1ba54639-d042-44ac-817d-31297e950a5f","keyName":"e2e-rate-b-128fbe","selected_subscription":"e2e-rate-iso-b-128fbe","selected_subscription_key":"ai-tenant-e2e-shared-b-5a36a6/e2e-rate-iso-b-128fbe@ai-tenant-e2e-shared-b-5a36a6/rate-test-model-5a36a6","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-5a36a6","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-128fbe","namespace":"ai-tenant-e2e-shared-b-5a36a6","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-b-5a36a6/rate-test-model-5a36a6"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-21T17:47:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d9dd60d1-2394-41bb-bb87-530cc7778542","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-21T17:47:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d9dd60d1-2394-41bb-bb87-530cc7778542","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-21T17:47:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b84bf956fa6e7b565ba00271da322e0345b06f89df9b58c75e12baf7c761c8b7"}
{"level":"info","ts":"2026-07-21T17:47:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ce9ae44560d24872155b0c11f5bba1a2c9e9ff61413a664817d56dca9260fb39"}
{"level":"info","ts":"2026-07-21T17:47:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9ca5cbe75d89f2d8f9d90b980a6cf979923041133e23d843747d0a7514883514"}
{"level":"info","ts":"2026-07-21T17:47:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/72fcb6314b0ce63404ef0bc1b7fccc688aa12f2a8c5a5d3e9ea339d9091c3fed"}
{"level":"info","ts":"2026-07-21T17:47:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6feda21c0fc67e06fb2e22d8f0e81be19d00adbb8ca121fb8f5dda549f5bcce1"}
{"level":"info","ts":"2026-07-21T17:47:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/867845942b8252f5d8d26e1f797c23e0963cc72c48b68848e386d7fdb1b5f718"}
{"level":"info","ts":"2026-07-21T17:47:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/102db7ad381949ac93de24eccb1546ce9ff7462b2e3b2b28aeaa90984ac95163"}
{"level":"info","ts":"2026-07-21T17:47:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7f4e8382d9c666dd5d6bba7c2b267290c2ccf91932deb8399384764e9593db72"}
{"level":"info","ts":"2026-07-21T17:47:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3af420a243cfaf94da91cd999a7327a5799f6e0e43264cf7595bbd9e6ca64c9b"}
{"level":"info","ts":"2026-07-21T17:47:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/afb3c8628ab15f2b141d16b8aab7ae18a962158110f58fb5eb52b5a59507307c"}
{"level":"info","ts":"2026-07-21T17:47:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4947733f8c75cb2be93a36747a15df889686c15a18db4494da3a99a80e465a7f"}
{"level":"info","ts":"2026-07-21T17:47:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9c3c13449cd218695c978de67f0b60951d42ecaed24c76534e69f5e6555d0c53"}
{"level":"info","ts":"2026-07-21T17:47:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/477340e14eaf095def8aa0f3ad9dce54536e1c6cb053a17c1478ab314d8cf56a"}
{"level":"info","ts":"2026-07-21T17:47:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f0705fdb04ae3706a2ce86046daca0e5b73bcf99db56077b0c07a7dd4aab4fe4"}
{"level":"info","ts":"2026-07-21T17:47:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/226747967f1ad1ee678f5f39ec57b02e54817cf91b2f4131cfdcea96b36016ce"}
{"level":"info","ts":"2026-07-21T17:47:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4fde31eba84988e43411761b1438fb254423980b27e0d413a129891c7bd59475"}
{"level":"info","ts":"2026-07-21T17:47:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/209eeaa6b94ebc188acacd1f7603ab3c6648071d769fb67e0119657ec2701700"}
{"level":"info","ts":"2026-07-21T17:47:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c2d2fb8f5b0afc9bc0f35c8c146d1da07b07bbae7072b20fab84257e11a0f100"}
{"level":"info","ts":"2026-07-21T17:47:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/baac29086d8369ca9c79ed73040e1230091a3e0d3d8037699075b6ac58b38198"}
{"level":"info","ts":"2026-07-21T17:47:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f4a2fa2b07b60d4f6a5f83789f2c3633987d0e3dea301685b498ce57c95bfcc4"}
{"level":"info","ts":"2026-07-21T17:47:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/596067d9605c0f72d97e8a12b26266d2c946aa4f861e9a501fe219fe7a909c25"}
{"level":"info","ts":"2026-07-21T17:47:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/00e923fcacf42aa4eb720db3829fe7aa5c5dba3a734e43052073cba3fcfb64f8"}
{"level":"info","ts":"2026-07-21T17:47:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ee3eae7f4f990ad9ad916e25b1634b5713cf96699a46684e4acd478f3fcb0ff2"}
{"level":"info","ts":"2026-07-21T17:47:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e72c9b61a2b6c6b8c3b1c7d62dcf9bf7268c91a732291703a662ea28d273d041"}