{"level":"info","ts":"2026-07-07T22:42:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9d0d328281b4681d88231fd47e645d36ae8266b1e354668f94c480d583ce3c79"}
{"level":"info","ts":"2026-07-07T22:42:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fa4fc8fb726ee2ddf777caa45c4f01ba8122a2fd27f6dcfb61f20c732b4ca4ed"}
{"level":"debug","ts":"2026-07-07T22:42:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fa4fc8fb726ee2ddf777caa45c4f01ba8122a2fd27f6dcfb61f20c732b4ca4ed","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-07T22:42:54Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-07T22:42:54Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["fa4fc8fb726ee2ddf777caa45c4f01ba8122a2fd27f6dcfb61f20c732b4ca4ed"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T22:42:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fa4fc8fb726ee2ddf777caa45c4f01ba8122a2fd27f6dcfb61f20c732b4ca4ed","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T22:42:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fa4fc8fb726ee2ddf777caa45c4f01ba8122a2fd27f6dcfb61f20c732b4ca4ed","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-07T22:42:54Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-07T22:42:54Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T22:42:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fa4fc8fb726ee2ddf777caa45c4f01ba8122a2fd27f6dcfb61f20c732b4ca4ed","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T22:42:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fa4fc8fb726ee2ddf777caa45c4f01ba8122a2fd27f6dcfb61f20c732b4ca4ed","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T22:42:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fa4fc8fb726ee2ddf777caa45c4f01ba8122a2fd27f6dcfb61f20c732b4ca4ed","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-07T22:42:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fa4fc8fb726ee2ddf777caa45c4f01ba8122a2fd27f6dcfb61f20c732b4ca4ed"}
{"level":"debug","ts":"2026-07-07T22:42:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fa4fc8fb726ee2ddf777caa45c4f01ba8122a2fd27f6dcfb61f20c732b4ca4ed","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-07T22:42:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fa4fc8fb726ee2ddf777caa45c4f01ba8122a2fd27f6dcfb61f20c732b4ca4ed"}
{"level":"debug","ts":"2026-07-07T22:42:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fa4fc8fb726ee2ddf777caa45c4f01ba8122a2fd27f6dcfb61f20c732b4ca4ed","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-07T22:42:55Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-07T22:42:55Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["fa4fc8fb726ee2ddf777caa45c4f01ba8122a2fd27f6dcfb61f20c732b4ca4ed"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T22:42:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fa4fc8fb726ee2ddf777caa45c4f01ba8122a2fd27f6dcfb61f20c732b4ca4ed","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T22:42:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fa4fc8fb726ee2ddf777caa45c4f01ba8122a2fd27f6dcfb61f20c732b4ca4ed","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-07T22:42:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fa4fc8fb726ee2ddf777caa45c4f01ba8122a2fd27f6dcfb61f20c732b4ca4ed"}
{"level":"debug","ts":"2026-07-07T22:42:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"46535d5626a9121dcfac45ac163c65091295792bc0373b29a305c648bc49c9d6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-07T22:42:55Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-07T22:42:55Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T22:42:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"46535d5626a9121dcfac45ac163c65091295792bc0373b29a305c648bc49c9d6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T22:42:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"46535d5626a9121dcfac45ac163c65091295792bc0373b29a305c648bc49c9d6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T22:42:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"46535d5626a9121dcfac45ac163c65091295792bc0373b29a305c648bc49c9d6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T22:42:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"46535d5626a9121dcfac45ac163c65091295792bc0373b29a305c648bc49c9d6","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-07T22:42:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/46535d5626a9121dcfac45ac163c65091295792bc0373b29a305c648bc49c9d6"}
{"level":"info","ts":"2026-07-07T22:42:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/46535d5626a9121dcfac45ac163c65091295792bc0373b29a305c648bc49c9d6"}
{"level":"debug","ts":"2026-07-07T22:42:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"46535d5626a9121dcfac45ac163c65091295792bc0373b29a305c648bc49c9d6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-07T22:42:55Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-07T22:42:55Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["46535d5626a9121dcfac45ac163c65091295792bc0373b29a305c648bc49c9d6"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T22:42:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"46535d5626a9121dcfac45ac163c65091295792bc0373b29a305c648bc49c9d6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T22:42:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"46535d5626a9121dcfac45ac163c65091295792bc0373b29a305c648bc49c9d6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-07T22:42:55Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-07T22:42:55Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T22:42:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"46535d5626a9121dcfac45ac163c65091295792bc0373b29a305c648bc49c9d6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T22:42:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"efdbf10809a7d7c6aca941ce300d15bb7c1059debc608dc578e3745597be4d6c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-07T22:42:55Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-07T22:42:55Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T22:42:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/46535d5626a9121dcfac45ac163c65091295792bc0373b29a305c648bc49c9d6"}
{"level":"info","ts":"2026-07-07T22:42:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"efdbf10809a7d7c6aca941ce300d15bb7c1059debc608dc578e3745597be4d6c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T22:42:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"46535d5626a9121dcfac45ac163c65091295792bc0373b29a305c648bc49c9d6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-07T22:42:55Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-07T22:42:55Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["46535d5626a9121dcfac45ac163c65091295792bc0373b29a305c648bc49c9d6"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T22:42:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"46535d5626a9121dcfac45ac163c65091295792bc0373b29a305c648bc49c9d6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T22:42:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"efdbf10809a7d7c6aca941ce300d15bb7c1059debc608dc578e3745597be4d6c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-07T22:42:55Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-07T22:42:55Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T22:42:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/efdbf10809a7d7c6aca941ce300d15bb7c1059debc608dc578e3745597be4d6c"}
{"level":"info","ts":"2026-07-07T22:42:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"efdbf10809a7d7c6aca941ce300d15bb7c1059debc608dc578e3745597be4d6c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T22:42:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"46535d5626a9121dcfac45ac163c65091295792bc0373b29a305c648bc49c9d6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-07T22:42:55Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-07T22:42:55Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T22:42:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"46535d5626a9121dcfac45ac163c65091295792bc0373b29a305c648bc49c9d6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T22:42:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"efdbf10809a7d7c6aca941ce300d15bb7c1059debc608dc578e3745597be4d6c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-07T22:42:55Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-07T22:42:55Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["efdbf10809a7d7c6aca941ce300d15bb7c1059debc608dc578e3745597be4d6c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T22:42:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/46535d5626a9121dcfac45ac163c65091295792bc0373b29a305c648bc49c9d6"}
{"level":"info","ts":"2026-07-07T22:42:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"efdbf10809a7d7c6aca941ce300d15bb7c1059debc608dc578e3745597be4d6c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T22:42:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"46535d5626a9121dcfac45ac163c65091295792bc0373b29a305c648bc49c9d6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-07T22:42:55Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-07T22:42:55Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["46535d5626a9121dcfac45ac163c65091295792bc0373b29a305c648bc49c9d6"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T22:42:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"46535d5626a9121dcfac45ac163c65091295792bc0373b29a305c648bc49c9d6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T22:42:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"efdbf10809a7d7c6aca941ce300d15bb7c1059debc608dc578e3745597be4d6c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-07T22:42:55Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-07T22:42:55Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T22:42:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/efdbf10809a7d7c6aca941ce300d15bb7c1059debc608dc578e3745597be4d6c"}
{"level":"info","ts":"2026-07-07T22:42:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"efdbf10809a7d7c6aca941ce300d15bb7c1059debc608dc578e3745597be4d6c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T22:42:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"46535d5626a9121dcfac45ac163c65091295792bc0373b29a305c648bc49c9d6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-07T22:42:55Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-07T22:42:55Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T22:42:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/46535d5626a9121dcfac45ac163c65091295792bc0373b29a305c648bc49c9d6"}
{"level":"info","ts":"2026-07-07T22:42:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"46535d5626a9121dcfac45ac163c65091295792bc0373b29a305c648bc49c9d6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T22:42:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"efdbf10809a7d7c6aca941ce300d15bb7c1059debc608dc578e3745597be4d6c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T22:42:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"46535d5626a9121dcfac45ac163c65091295792bc0373b29a305c648bc49c9d6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-07T22:42:55Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-07T22:42:55Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["46535d5626a9121dcfac45ac163c65091295792bc0373b29a305c648bc49c9d6"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T22:42:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"46535d5626a9121dcfac45ac163c65091295792bc0373b29a305c648bc49c9d6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T22:42:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"efdbf10809a7d7c6aca941ce300d15bb7c1059debc608dc578e3745597be4d6c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T22:42:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"46535d5626a9121dcfac45ac163c65091295792bc0373b29a305c648bc49c9d6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-07T22:42:55Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-07T22:42:55Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["46535d5626a9121dcfac45ac163c65091295792bc0373b29a305c648bc49c9d6"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-07T22:42:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"46535d5626a9121dcfac45ac163c65091295792bc0373b29a305c648bc49c9d6","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"46535d5626a9121dcfac45ac163c65091295792bc0373b29a305c648bc49c9d6\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-07T22:42:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"46535d5626a9121dcfac45ac163c65091295792bc0373b29a305c648bc49c9d6","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-07T22:42:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/efdbf10809a7d7c6aca941ce300d15bb7c1059debc608dc578e3745597be4d6c"}
{"level":"debug","ts":"2026-07-07T22:42:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"46535d5626a9121dcfac45ac163c65091295792bc0373b29a305c648bc49c9d6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-07T22:42:55Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-07T22:42:55Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T22:42:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"46535d5626a9121dcfac45ac163c65091295792bc0373b29a305c648bc49c9d6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T22:42:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"efdbf10809a7d7c6aca941ce300d15bb7c1059debc608dc578e3745597be4d6c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-07T22:42:55Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-07T22:42:55Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["efdbf10809a7d7c6aca941ce300d15bb7c1059debc608dc578e3745597be4d6c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T22:42:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/46535d5626a9121dcfac45ac163c65091295792bc0373b29a305c648bc49c9d6"}
{"level":"info","ts":"2026-07-07T22:42:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"efdbf10809a7d7c6aca941ce300d15bb7c1059debc608dc578e3745597be4d6c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T22:42:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"46535d5626a9121dcfac45ac163c65091295792bc0373b29a305c648bc49c9d6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T22:42:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"efdbf10809a7d7c6aca941ce300d15bb7c1059debc608dc578e3745597be4d6c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T22:42:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"46535d5626a9121dcfac45ac163c65091295792bc0373b29a305c648bc49c9d6","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-07T22:42:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/46535d5626a9121dcfac45ac163c65091295792bc0373b29a305c648bc49c9d6"}
{"level":"debug","ts":"2026-07-07T22:42:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"46535d5626a9121dcfac45ac163c65091295792bc0373b29a305c648bc49c9d6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-07T22:42:55Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-07T22:42:55Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["46535d5626a9121dcfac45ac163c65091295792bc0373b29a305c648bc49c9d6"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T22:42:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"46535d5626a9121dcfac45ac163c65091295792bc0373b29a305c648bc49c9d6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T22:42:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"46535d5626a9121dcfac45ac163c65091295792bc0373b29a305c648bc49c9d6","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-07T22:42:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/efdbf10809a7d7c6aca941ce300d15bb7c1059debc608dc578e3745597be4d6c"}
{"level":"info","ts":"2026-07-07T22:42:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/46535d5626a9121dcfac45ac163c65091295792bc0373b29a305c648bc49c9d6"}
{"level":"debug","ts":"2026-07-07T22:43:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"30f3319f99a8abd4eba8f1598ca6b939fa1b069577f1a85b7e722fbad99457bf","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-07T22:43:12Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-07T22:43:12Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T22:43:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"30f3319f99a8abd4eba8f1598ca6b939fa1b069577f1a85b7e722fbad99457bf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T22:43:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"30f3319f99a8abd4eba8f1598ca6b939fa1b069577f1a85b7e722fbad99457bf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T22:43:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"30f3319f99a8abd4eba8f1598ca6b939fa1b069577f1a85b7e722fbad99457bf","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-07T22:43:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/30f3319f99a8abd4eba8f1598ca6b939fa1b069577f1a85b7e722fbad99457bf"}
{"level":"debug","ts":"2026-07-07T22:43:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"30f3319f99a8abd4eba8f1598ca6b939fa1b069577f1a85b7e722fbad99457bf","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-07T22:43:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/30f3319f99a8abd4eba8f1598ca6b939fa1b069577f1a85b7e722fbad99457bf"}
{"level":"debug","ts":"2026-07-07T22:43:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"30f3319f99a8abd4eba8f1598ca6b939fa1b069577f1a85b7e722fbad99457bf","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-07T22:43:12Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-07T22:43:12Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["30f3319f99a8abd4eba8f1598ca6b939fa1b069577f1a85b7e722fbad99457bf"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T22:43:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"30f3319f99a8abd4eba8f1598ca6b939fa1b069577f1a85b7e722fbad99457bf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T22:43:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"30f3319f99a8abd4eba8f1598ca6b939fa1b069577f1a85b7e722fbad99457bf","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-07T22:43:12Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-07T22:43:12Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T22:43:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"30f3319f99a8abd4eba8f1598ca6b939fa1b069577f1a85b7e722fbad99457bf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T22:43:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"30f3319f99a8abd4eba8f1598ca6b939fa1b069577f1a85b7e722fbad99457bf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T22:43:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"30f3319f99a8abd4eba8f1598ca6b939fa1b069577f1a85b7e722fbad99457bf","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-07T22:43:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/30f3319f99a8abd4eba8f1598ca6b939fa1b069577f1a85b7e722fbad99457bf"}
{"level":"debug","ts":"2026-07-07T22:43:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"30f3319f99a8abd4eba8f1598ca6b939fa1b069577f1a85b7e722fbad99457bf","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-07T22:43:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/30f3319f99a8abd4eba8f1598ca6b939fa1b069577f1a85b7e722fbad99457bf"}
{"level":"debug","ts":"2026-07-07T22:43:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"30f3319f99a8abd4eba8f1598ca6b939fa1b069577f1a85b7e722fbad99457bf","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-07T22:43:12Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-07T22:43:12Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["30f3319f99a8abd4eba8f1598ca6b939fa1b069577f1a85b7e722fbad99457bf"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T22:43:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"30f3319f99a8abd4eba8f1598ca6b939fa1b069577f1a85b7e722fbad99457bf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T22:43:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"30f3319f99a8abd4eba8f1598ca6b939fa1b069577f1a85b7e722fbad99457bf","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-07T22:43:12Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-07T22:43:12Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T22:43:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"30f3319f99a8abd4eba8f1598ca6b939fa1b069577f1a85b7e722fbad99457bf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T22:43:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"30f3319f99a8abd4eba8f1598ca6b939fa1b069577f1a85b7e722fbad99457bf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T22:43:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3d38fbf2c5357d325a382939175e7bc43b30a9f696bb0c7249dc1bbf43a6ca5a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T22:43:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"30f3319f99a8abd4eba8f1598ca6b939fa1b069577f1a85b7e722fbad99457bf","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-07T22:43:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/30f3319f99a8abd4eba8f1598ca6b939fa1b069577f1a85b7e722fbad99457bf"}
{"level":"debug","ts":"2026-07-07T22:43:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"30f3319f99a8abd4eba8f1598ca6b939fa1b069577f1a85b7e722fbad99457bf","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-07T22:43:12Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-07T22:43:12Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["30f3319f99a8abd4eba8f1598ca6b939fa1b069577f1a85b7e722fbad99457bf"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T22:43:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3d38fbf2c5357d325a382939175e7bc43b30a9f696bb0c7249dc1bbf43a6ca5a"}
{"level":"info","ts":"2026-07-07T22:43:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"30f3319f99a8abd4eba8f1598ca6b939fa1b069577f1a85b7e722fbad99457bf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T22:43:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"30f3319f99a8abd4eba8f1598ca6b939fa1b069577f1a85b7e722fbad99457bf","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-07T22:43:12Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-07T22:43:12Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T22:43:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"30f3319f99a8abd4eba8f1598ca6b939fa1b069577f1a85b7e722fbad99457bf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T22:43:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"30f3319f99a8abd4eba8f1598ca6b939fa1b069577f1a85b7e722fbad99457bf","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-07T22:43:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/30f3319f99a8abd4eba8f1598ca6b939fa1b069577f1a85b7e722fbad99457bf"}
{"level":"debug","ts":"2026-07-07T22:43:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"30f3319f99a8abd4eba8f1598ca6b939fa1b069577f1a85b7e722fbad99457bf","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-07T22:43:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/30f3319f99a8abd4eba8f1598ca6b939fa1b069577f1a85b7e722fbad99457bf"}
{"level":"debug","ts":"2026-07-07T22:43:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"30f3319f99a8abd4eba8f1598ca6b939fa1b069577f1a85b7e722fbad99457bf","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-07T22:43:12Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-07T22:43:12Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["30f3319f99a8abd4eba8f1598ca6b939fa1b069577f1a85b7e722fbad99457bf"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T22:43:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"30f3319f99a8abd4eba8f1598ca6b939fa1b069577f1a85b7e722fbad99457bf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T22:43:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"30f3319f99a8abd4eba8f1598ca6b939fa1b069577f1a85b7e722fbad99457bf","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-07T22:43:12Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-07T22:43:12Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T22:43:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"30f3319f99a8abd4eba8f1598ca6b939fa1b069577f1a85b7e722fbad99457bf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T22:43:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"efdbf10809a7d7c6aca941ce300d15bb7c1059debc608dc578e3745597be4d6c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T22:43:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"30f3319f99a8abd4eba8f1598ca6b939fa1b069577f1a85b7e722fbad99457bf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T22:43:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"30f3319f99a8abd4eba8f1598ca6b939fa1b069577f1a85b7e722fbad99457bf","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-07T22:43:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/30f3319f99a8abd4eba8f1598ca6b939fa1b069577f1a85b7e722fbad99457bf"}
{"level":"debug","ts":"2026-07-07T22:43:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"30f3319f99a8abd4eba8f1598ca6b939fa1b069577f1a85b7e722fbad99457bf","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-07T22:43:12Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-07T22:43:12Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["30f3319f99a8abd4eba8f1598ca6b939fa1b069577f1a85b7e722fbad99457bf"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T22:43:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/efdbf10809a7d7c6aca941ce300d15bb7c1059debc608dc578e3745597be4d6c"}
{"level":"info","ts":"2026-07-07T22:43:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"30f3319f99a8abd4eba8f1598ca6b939fa1b069577f1a85b7e722fbad99457bf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T22:43:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"30f3319f99a8abd4eba8f1598ca6b939fa1b069577f1a85b7e722fbad99457bf","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-07T22:43:12Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-07T22:43:12Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T22:43:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"30f3319f99a8abd4eba8f1598ca6b939fa1b069577f1a85b7e722fbad99457bf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T22:43:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"30f3319f99a8abd4eba8f1598ca6b939fa1b069577f1a85b7e722fbad99457bf","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-07T22:43:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/30f3319f99a8abd4eba8f1598ca6b939fa1b069577f1a85b7e722fbad99457bf"}
{"level":"debug","ts":"2026-07-07T22:43:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"30f3319f99a8abd4eba8f1598ca6b939fa1b069577f1a85b7e722fbad99457bf","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-07T22:43:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/30f3319f99a8abd4eba8f1598ca6b939fa1b069577f1a85b7e722fbad99457bf"}
{"level":"debug","ts":"2026-07-07T22:43:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"30f3319f99a8abd4eba8f1598ca6b939fa1b069577f1a85b7e722fbad99457bf","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-07T22:43:12Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-07T22:43:12Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["30f3319f99a8abd4eba8f1598ca6b939fa1b069577f1a85b7e722fbad99457bf"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T22:43:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"30f3319f99a8abd4eba8f1598ca6b939fa1b069577f1a85b7e722fbad99457bf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T22:43:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"30f3319f99a8abd4eba8f1598ca6b939fa1b069577f1a85b7e722fbad99457bf","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-07T22:43:12Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-07T22:43:12Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T22:43:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"30f3319f99a8abd4eba8f1598ca6b939fa1b069577f1a85b7e722fbad99457bf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T22:43:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"30f3319f99a8abd4eba8f1598ca6b939fa1b069577f1a85b7e722fbad99457bf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T22:43:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"30f3319f99a8abd4eba8f1598ca6b939fa1b069577f1a85b7e722fbad99457bf","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-07T22:43:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/30f3319f99a8abd4eba8f1598ca6b939fa1b069577f1a85b7e722fbad99457bf"}
{"level":"debug","ts":"2026-07-07T22:43:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"30f3319f99a8abd4eba8f1598ca6b939fa1b069577f1a85b7e722fbad99457bf","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-07T22:43:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/30f3319f99a8abd4eba8f1598ca6b939fa1b069577f1a85b7e722fbad99457bf"}
{"level":"debug","ts":"2026-07-07T22:43:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"30f3319f99a8abd4eba8f1598ca6b939fa1b069577f1a85b7e722fbad99457bf","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-07T22:43:12Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-07T22:43:12Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["30f3319f99a8abd4eba8f1598ca6b939fa1b069577f1a85b7e722fbad99457bf"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T22:43:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"30f3319f99a8abd4eba8f1598ca6b939fa1b069577f1a85b7e722fbad99457bf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T22:43:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"30f3319f99a8abd4eba8f1598ca6b939fa1b069577f1a85b7e722fbad99457bf","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-07T22:43:12Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-07T22:43:12Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T22:43:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"30f3319f99a8abd4eba8f1598ca6b939fa1b069577f1a85b7e722fbad99457bf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T22:43:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5868fbcf0daf8e82f1266b1d5366d560f4633a34faf9b7ab370d5af47c36faa3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T22:43:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"30f3319f99a8abd4eba8f1598ca6b939fa1b069577f1a85b7e722fbad99457bf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T22:43:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"30f3319f99a8abd4eba8f1598ca6b939fa1b069577f1a85b7e722fbad99457bf","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-07T22:43:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/30f3319f99a8abd4eba8f1598ca6b939fa1b069577f1a85b7e722fbad99457bf"}
{"level":"debug","ts":"2026-07-07T22:43:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"30f3319f99a8abd4eba8f1598ca6b939fa1b069577f1a85b7e722fbad99457bf","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-07T22:43:12Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-07T22:43:12Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["30f3319f99a8abd4eba8f1598ca6b939fa1b069577f1a85b7e722fbad99457bf"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T22:43:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5868fbcf0daf8e82f1266b1d5366d560f4633a34faf9b7ab370d5af47c36faa3"}
{"level":"info","ts":"2026-07-07T22:43:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"30f3319f99a8abd4eba8f1598ca6b939fa1b069577f1a85b7e722fbad99457bf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T22:43:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"30f3319f99a8abd4eba8f1598ca6b939fa1b069577f1a85b7e722fbad99457bf","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-07T22:43:12Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-07T22:43:12Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T22:43:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/30f3319f99a8abd4eba8f1598ca6b939fa1b069577f1a85b7e722fbad99457bf"}
{"level":"info","ts":"2026-07-07T22:43:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"30f3319f99a8abd4eba8f1598ca6b939fa1b069577f1a85b7e722fbad99457bf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T22:43:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"30f3319f99a8abd4eba8f1598ca6b939fa1b069577f1a85b7e722fbad99457bf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T22:43:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"30f3319f99a8abd4eba8f1598ca6b939fa1b069577f1a85b7e722fbad99457bf","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-07T22:43:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/30f3319f99a8abd4eba8f1598ca6b939fa1b069577f1a85b7e722fbad99457bf"}
{"level":"debug","ts":"2026-07-07T22:43:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"30f3319f99a8abd4eba8f1598ca6b939fa1b069577f1a85b7e722fbad99457bf","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-07T22:43:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/30f3319f99a8abd4eba8f1598ca6b939fa1b069577f1a85b7e722fbad99457bf"}
{"level":"debug","ts":"2026-07-07T22:43:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9e5d92dee0f169f3c6d564d220aea73e8b166cb0ad6e1dfca1f360493d80910f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-07T22:43:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9e5d92dee0f169f3c6d564d220aea73e8b166cb0ad6e1dfca1f360493d80910f"}
{"level":"debug","ts":"2026-07-07T22:43:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"30f3319f99a8abd4eba8f1598ca6b939fa1b069577f1a85b7e722fbad99457bf","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-07T22:43:12Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-07T22:43:12Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["30f3319f99a8abd4eba8f1598ca6b939fa1b069577f1a85b7e722fbad99457bf"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T22:43:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"30f3319f99a8abd4eba8f1598ca6b939fa1b069577f1a85b7e722fbad99457bf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T22:43:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"30f3319f99a8abd4eba8f1598ca6b939fa1b069577f1a85b7e722fbad99457bf","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-07T22:43:13Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-07T22:43:13Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T22:43:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"30f3319f99a8abd4eba8f1598ca6b939fa1b069577f1a85b7e722fbad99457bf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T22:43:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"30f3319f99a8abd4eba8f1598ca6b939fa1b069577f1a85b7e722fbad99457bf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T22:43:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"30f3319f99a8abd4eba8f1598ca6b939fa1b069577f1a85b7e722fbad99457bf","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-07T22:43:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/30f3319f99a8abd4eba8f1598ca6b939fa1b069577f1a85b7e722fbad99457bf"}
{"level":"debug","ts":"2026-07-07T22:43:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"30f3319f99a8abd4eba8f1598ca6b939fa1b069577f1a85b7e722fbad99457bf","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-07T22:43:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/30f3319f99a8abd4eba8f1598ca6b939fa1b069577f1a85b7e722fbad99457bf"}
{"level":"debug","ts":"2026-07-07T22:43:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2b629cfd64cae59244768bdc9e5f6a6a35bee33e9a112db902b74acd1fbcc764","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-07T22:43:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2b629cfd64cae59244768bdc9e5f6a6a35bee33e9a112db902b74acd1fbcc764"}
{"level":"debug","ts":"2026-07-07T22:43:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"30f3319f99a8abd4eba8f1598ca6b939fa1b069577f1a85b7e722fbad99457bf","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-07T22:43:13Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-07T22:43:13Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["30f3319f99a8abd4eba8f1598ca6b939fa1b069577f1a85b7e722fbad99457bf"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T22:43:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"30f3319f99a8abd4eba8f1598ca6b939fa1b069577f1a85b7e722fbad99457bf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T22:43:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"30f3319f99a8abd4eba8f1598ca6b939fa1b069577f1a85b7e722fbad99457bf","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-07T22:43:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/30f3319f99a8abd4eba8f1598ca6b939fa1b069577f1a85b7e722fbad99457bf"}
{"level":"debug","ts":"2026-07-07T22:43:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9a8567710872db35882e39159253d625ee92e29486331d26f348f7d45fdc1a08","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-07T22:43:13Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-07T22:43:13Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T22:43:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9a8567710872db35882e39159253d625ee92e29486331d26f348f7d45fdc1a08","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T22:43:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9a8567710872db35882e39159253d625ee92e29486331d26f348f7d45fdc1a08","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T22:43:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9a8567710872db35882e39159253d625ee92e29486331d26f348f7d45fdc1a08","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-07T22:43:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9a8567710872db35882e39159253d625ee92e29486331d26f348f7d45fdc1a08"}
{"level":"debug","ts":"2026-07-07T22:43:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9a8567710872db35882e39159253d625ee92e29486331d26f348f7d45fdc1a08","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-07T22:43:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9a8567710872db35882e39159253d625ee92e29486331d26f348f7d45fdc1a08"}
{"level":"debug","ts":"2026-07-07T22:43:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9a8567710872db35882e39159253d625ee92e29486331d26f348f7d45fdc1a08","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-07T22:43:13Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-07T22:43:13Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9a8567710872db35882e39159253d625ee92e29486331d26f348f7d45fdc1a08"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T22:43:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9a8567710872db35882e39159253d625ee92e29486331d26f348f7d45fdc1a08","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T22:43:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9a8567710872db35882e39159253d625ee92e29486331d26f348f7d45fdc1a08","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-07T22:43:13Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-07T22:43:13Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T22:43:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9a8567710872db35882e39159253d625ee92e29486331d26f348f7d45fdc1a08","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T22:43:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9d0d328281b4681d88231fd47e645d36ae8266b1e354668f94c480d583ce3c79","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T22:43:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9a8567710872db35882e39159253d625ee92e29486331d26f348f7d45fdc1a08","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-07T22:43:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9a8567710872db35882e39159253d625ee92e29486331d26f348f7d45fdc1a08"}
{"level":"debug","ts":"2026-07-07T22:43:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9a8567710872db35882e39159253d625ee92e29486331d26f348f7d45fdc1a08","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-07T22:43:13Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-07T22:43:13Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9a8567710872db35882e39159253d625ee92e29486331d26f348f7d45fdc1a08"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T22:43:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9a8567710872db35882e39159253d625ee92e29486331d26f348f7d45fdc1a08","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T22:43:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9a8567710872db35882e39159253d625ee92e29486331d26f348f7d45fdc1a08","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-07T22:43:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9d0d328281b4681d88231fd47e645d36ae8266b1e354668f94c480d583ce3c79"}
{"level":"info","ts":"2026-07-07T22:43:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9a8567710872db35882e39159253d625ee92e29486331d26f348f7d45fdc1a08"}
{"level":"debug","ts":"2026-07-07T22:43:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"eb6677a84f2011c8778e746156db2939d5a85331d1da5327e5a965925b8554bd","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-07T22:43:13Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-07T22:43:13Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T22:43:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"eb6677a84f2011c8778e746156db2939d5a85331d1da5327e5a965925b8554bd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T22:43:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"eb6677a84f2011c8778e746156db2939d5a85331d1da5327e5a965925b8554bd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T22:43:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"eb6677a84f2011c8778e746156db2939d5a85331d1da5327e5a965925b8554bd","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-07T22:43:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/eb6677a84f2011c8778e746156db2939d5a85331d1da5327e5a965925b8554bd"}
{"level":"debug","ts":"2026-07-07T22:43:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"eb6677a84f2011c8778e746156db2939d5a85331d1da5327e5a965925b8554bd","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-07T22:43:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/eb6677a84f2011c8778e746156db2939d5a85331d1da5327e5a965925b8554bd"}
{"level":"debug","ts":"2026-07-07T22:43:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"eb6677a84f2011c8778e746156db2939d5a85331d1da5327e5a965925b8554bd","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-07T22:43:13Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-07T22:43:13Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["eb6677a84f2011c8778e746156db2939d5a85331d1da5327e5a965925b8554bd"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T22:43:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"eb6677a84f2011c8778e746156db2939d5a85331d1da5327e5a965925b8554bd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T22:43:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"eb6677a84f2011c8778e746156db2939d5a85331d1da5327e5a965925b8554bd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T22:43:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"37c848544fbf721a00bd83a4cbf714a418c37835955df6db151199ad83b3b33d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-07T22:43:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/eb6677a84f2011c8778e746156db2939d5a85331d1da5327e5a965925b8554bd"}
{"level":"info","ts":"2026-07-07T22:43:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/37c848544fbf721a00bd83a4cbf714a418c37835955df6db151199ad83b3b33d"}
{"level":"debug","ts":"2026-07-07T22:43:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2bcb797645fe5e47cd6e2885312f786747d66763e405987d9dda625f3038904e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-07T22:43:13Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-07T22:43:13Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T22:43:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2bcb797645fe5e47cd6e2885312f786747d66763e405987d9dda625f3038904e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T22:43:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9f495b00a13ca18a774cc8756429484a6789dee774595fe4fb9e2ce95a125d3e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T22:43:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2bcb797645fe5e47cd6e2885312f786747d66763e405987d9dda625f3038904e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T22:43:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2bcb797645fe5e47cd6e2885312f786747d66763e405987d9dda625f3038904e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-07T22:43:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2bcb797645fe5e47cd6e2885312f786747d66763e405987d9dda625f3038904e"}
{"level":"debug","ts":"2026-07-07T22:43:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2bcb797645fe5e47cd6e2885312f786747d66763e405987d9dda625f3038904e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-07T22:43:13Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-07T22:43:13Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["2bcb797645fe5e47cd6e2885312f786747d66763e405987d9dda625f3038904e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T22:43:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9f495b00a13ca18a774cc8756429484a6789dee774595fe4fb9e2ce95a125d3e"}
{"level":"info","ts":"2026-07-07T22:43:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2bcb797645fe5e47cd6e2885312f786747d66763e405987d9dda625f3038904e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T22:43:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2bcb797645fe5e47cd6e2885312f786747d66763e405987d9dda625f3038904e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-07T22:43:13Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-07T22:43:13Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T22:43:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2bcb797645fe5e47cd6e2885312f786747d66763e405987d9dda625f3038904e"}
{"level":"info","ts":"2026-07-07T22:43:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2bcb797645fe5e47cd6e2885312f786747d66763e405987d9dda625f3038904e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T22:43:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2bcb797645fe5e47cd6e2885312f786747d66763e405987d9dda625f3038904e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T22:43:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2bcb797645fe5e47cd6e2885312f786747d66763e405987d9dda625f3038904e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-07T22:43:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2bcb797645fe5e47cd6e2885312f786747d66763e405987d9dda625f3038904e"}
{"level":"debug","ts":"2026-07-07T22:43:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fa4fc8fb726ee2ddf777caa45c4f01ba8122a2fd27f6dcfb61f20c732b4ca4ed","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T22:43:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2bcb797645fe5e47cd6e2885312f786747d66763e405987d9dda625f3038904e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-07T22:43:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2bcb797645fe5e47cd6e2885312f786747d66763e405987d9dda625f3038904e"}
{"level":"debug","ts":"2026-07-07T22:43:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8ce83f609dcfe400b54e0a76c4a85fda2b09af080d7d4474d301a28676264cf7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-07T22:43:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fa4fc8fb726ee2ddf777caa45c4f01ba8122a2fd27f6dcfb61f20c732b4ca4ed"}
{"level":"debug","ts":"2026-07-07T22:43:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2bcb797645fe5e47cd6e2885312f786747d66763e405987d9dda625f3038904e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-07T22:43:13Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-07T22:43:13Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["2bcb797645fe5e47cd6e2885312f786747d66763e405987d9dda625f3038904e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T22:43:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2bcb797645fe5e47cd6e2885312f786747d66763e405987d9dda625f3038904e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T22:43:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2bcb797645fe5e47cd6e2885312f786747d66763e405987d9dda625f3038904e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-07T22:43:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8ce83f609dcfe400b54e0a76c4a85fda2b09af080d7d4474d301a28676264cf7"}
{"level":"info","ts":"2026-07-07T22:43:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2bcb797645fe5e47cd6e2885312f786747d66763e405987d9dda625f3038904e"}
{"level":"debug","ts":"2026-07-07T22:43:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"46535d5626a9121dcfac45ac163c65091295792bc0373b29a305c648bc49c9d6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-07T22:43:13Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-07T22:43:13Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T22:43:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"46535d5626a9121dcfac45ac163c65091295792bc0373b29a305c648bc49c9d6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T22:43:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"46535d5626a9121dcfac45ac163c65091295792bc0373b29a305c648bc49c9d6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T22:43:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4a381ef84795049e53ccfc27eaf9e3cb72f34c5e61e5932e68dbcdc29b57ed81","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T22:43:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"46535d5626a9121dcfac45ac163c65091295792bc0373b29a305c648bc49c9d6","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-07T22:43:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/46535d5626a9121dcfac45ac163c65091295792bc0373b29a305c648bc49c9d6"}
{"level":"debug","ts":"2026-07-07T22:43:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fb9f3794828bc493dd23d246d4f008fa508f782d8f0494e7bfd35c2bdfb4ecc8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T22:43:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"46535d5626a9121dcfac45ac163c65091295792bc0373b29a305c648bc49c9d6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-07T22:43:14Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-07T22:43:14Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["46535d5626a9121dcfac45ac163c65091295792bc0373b29a305c648bc49c9d6"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T22:43:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4a381ef84795049e53ccfc27eaf9e3cb72f34c5e61e5932e68dbcdc29b57ed81"}
{"level":"info","ts":"2026-07-07T22:43:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"46535d5626a9121dcfac45ac163c65091295792bc0373b29a305c648bc49c9d6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T22:43:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"87bf5b8955ff4146107c38fa804a280767b67ff65bf70de5c51a191288803ad3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T22:43:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"46535d5626a9121dcfac45ac163c65091295792bc0373b29a305c648bc49c9d6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-07T22:43:14Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-07T22:43:14Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T22:43:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/46535d5626a9121dcfac45ac163c65091295792bc0373b29a305c648bc49c9d6"}
{"level":"info","ts":"2026-07-07T22:43:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"46535d5626a9121dcfac45ac163c65091295792bc0373b29a305c648bc49c9d6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T22:43:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"46535d5626a9121dcfac45ac163c65091295792bc0373b29a305c648bc49c9d6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-07T22:43:14Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-07T22:43:14Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["46535d5626a9121dcfac45ac163c65091295792bc0373b29a305c648bc49c9d6"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T22:43:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"46535d5626a9121dcfac45ac163c65091295792bc0373b29a305c648bc49c9d6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T22:43:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"46535d5626a9121dcfac45ac163c65091295792bc0373b29a305c648bc49c9d6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-07T22:43:14Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-07T22:43:14Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["46535d5626a9121dcfac45ac163c65091295792bc0373b29a305c648bc49c9d6"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T22:43:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fb9f3794828bc493dd23d246d4f008fa508f782d8f0494e7bfd35c2bdfb4ecc8"}
{"level":"error","ts":"2026-07-07T22:43:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"46535d5626a9121dcfac45ac163c65091295792bc0373b29a305c648bc49c9d6","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"46535d5626a9121dcfac45ac163c65091295792bc0373b29a305c648bc49c9d6\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-07T22:43:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"46535d5626a9121dcfac45ac163c65091295792bc0373b29a305c648bc49c9d6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T22:43:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c029c45bc858b1ee6f98e11cc3dfd00592a5a63edaff2871468acb37bb074b63","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T22:43:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"46535d5626a9121dcfac45ac163c65091295792bc0373b29a305c648bc49c9d6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T22:43:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"915cd1c390dc31ed035f8a8efd60dc86c2c462f873e58636b566b3f80e68c715","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-07T22:43:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/87bf5b8955ff4146107c38fa804a280767b67ff65bf70de5c51a191288803ad3"}
{"level":"info","ts":"2026-07-07T22:43:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/46535d5626a9121dcfac45ac163c65091295792bc0373b29a305c648bc49c9d6"}
{"level":"info","ts":"2026-07-07T22:43:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c029c45bc858b1ee6f98e11cc3dfd00592a5a63edaff2871468acb37bb074b63"}
{"level":"info","ts":"2026-07-07T22:43:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/915cd1c390dc31ed035f8a8efd60dc86c2c462f873e58636b566b3f80e68c715"}
{"level":"info","ts":"2026-07-07T22:43:15Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6e369672-3374-4919-9434-e54359b9e5af","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:49146","PortSpecifier":{"PortValue":49146}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.43:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6e369672-3374-4919-9434-e54359b9e5af","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-41e952.apps.c16f4dfd-eb23-495f-acc2-7352d9229b8d.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T22:43:15Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6e369672-3374-4919-9434-e54359b9e5af","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:49146","PortSpecifier":{"PortValue":49146}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.43:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783464195,"nanos":906371971},"http":{"id":"6e369672-3374-4919-9434-e54359b9e5af","method":"POST","headers":{":authority":"e2e-shared-a-41e952.apps.c16f4dfd-eb23-495f-acc2-7352d9229b8d.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T22:43:15Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"6e369672-3374-4919-9434-e54359b9e5af","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T22:43:15Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6e369672-3374-4919-9434-e54359b9e5af","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"bb4924e6-aa4e-47bc-bc23-287bb2409310","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=d20e4333-b741-405f-90ea-62e9cb59fc3b"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7352d9229b8d"]}}
{"level":"debug","ts":"2026-07-07T22:43:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6e369672-3374-4919-9434-e54359b9e5af","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7352d9229b8d"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=d20e4333-b741-405f-90ea-62e9cb59fc3b"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"bb4924e6-aa4e-47bc-bc23-287bb2409310","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"9a8567710872db35882e39159253d625ee92e29486331d26f348f7d45fdc1a08"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.43:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-41e952.apps.c16f4dfd-eb23-495f-acc2-7352d9229b8d.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T22:43:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6e369672-3374-4919-9434-e54359b9e5af","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T22:43:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6e369672-3374-4919-9434-e54359b9e5af","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T22:43:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6e369672-3374-4919-9434-e54359b9e5af","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-41e952/rate-test-model-41e952\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T22:43:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"6e369672-3374-4919-9434-e54359b9e5af","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T22:43:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6e369672-3374-4919-9434-e54359b9e5af","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T22:43:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6e369672-3374-4919-9434-e54359b9e5af","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T22:43:15Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6e369672-3374-4919-9434-e54359b9e5af","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T22:43:15Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6e369672-3374-4919-9434-e54359b9e5af","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T22:43:15Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4a6cb2d6-3369-45ef-b5ce-e666e64ba898","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:37376","PortSpecifier":{"PortValue":37376}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"4a6cb2d6-3369-45ef-b5ce-e666e64ba898","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-a4bfe6.apps.c16f4dfd-eb23-495f-acc2-7352d9229b8d.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T22:43:15Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4a6cb2d6-3369-45ef-b5ce-e666e64ba898","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:37376","PortSpecifier":{"PortValue":37376}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783464195,"nanos":966673677},"http":{"id":"4a6cb2d6-3369-45ef-b5ce-e666e64ba898","method":"POST","headers":{":authority":"e2e-shared-b-a4bfe6.apps.c16f4dfd-eb23-495f-acc2-7352d9229b8d.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T22:43:15Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"4a6cb2d6-3369-45ef-b5ce-e666e64ba898","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T22:43:15Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"4a6cb2d6-3369-45ef-b5ce-e666e64ba898","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"bb4924e6-aa4e-47bc-bc23-287bb2409310","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=d20e4333-b741-405f-90ea-62e9cb59fc3b"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7352d9229b8d"]}}
{"level":"debug","ts":"2026-07-07T22:43:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"4a6cb2d6-3369-45ef-b5ce-e666e64ba898","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7352d9229b8d"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=d20e4333-b741-405f-90ea-62e9cb59fc3b"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"bb4924e6-aa4e-47bc-bc23-287bb2409310","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"eb6677a84f2011c8778e746156db2939d5a85331d1da5327e5a965925b8554bd"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.44:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-a4bfe6.apps.c16f4dfd-eb23-495f-acc2-7352d9229b8d.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T22:43:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4a6cb2d6-3369-45ef-b5ce-e666e64ba898","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T22:43:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4a6cb2d6-3369-45ef-b5ce-e666e64ba898","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T22:43:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4a6cb2d6-3369-45ef-b5ce-e666e64ba898","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-a4bfe6/rate-test-model-a4bfe6\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T22:43:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"4a6cb2d6-3369-45ef-b5ce-e666e64ba898","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T22:43:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4a6cb2d6-3369-45ef-b5ce-e666e64ba898","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T22:43:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4a6cb2d6-3369-45ef-b5ce-e666e64ba898","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-07T22:43:15Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4a6cb2d6-3369-45ef-b5ce-e666e64ba898","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T22:43:15Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4a6cb2d6-3369-45ef-b5ce-e666e64ba898","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T22:43:16Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7a6ba944-2d29-40e4-92c2-3073e1641d0e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:44748","PortSpecifier":{"PortValue":44748}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.43:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"7a6ba944-2d29-40e4-92c2-3073e1641d0e","method":"POST","path":"/ai-tenant-e2e-shared-a-41e952/rate-test-model-41e952/v1/completions","host":"e2e-shared-a-41e952.apps.c16f4dfd-eb23-495f-acc2-7352d9229b8d.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T22:43:16Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7a6ba944-2d29-40e4-92c2-3073e1641d0e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:44748","PortSpecifier":{"PortValue":44748}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.43:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783464196,"nanos":1565885},"http":{"id":"7a6ba944-2d29-40e4-92c2-3073e1641d0e","method":"POST","headers":{":authority":"e2e-shared-a-41e952.apps.c16f4dfd-eb23-495f-acc2-7352d9229b8d.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-41e952/rate-test-model-41e952/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T22:43:16Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"7a6ba944-2d29-40e4-92c2-3073e1641d0e","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1Nx6Zk4OJ0SDjScGb_LmhCVPs7gKPa8xgysdNpr1qeEA7uYJs32kwylDgmU1b"}
{"level":"debug","ts":"2026-07-07T22:43:16Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"7a6ba944-2d29-40e4-92c2-3073e1641d0e","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-41e952.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1Nx6Zk4OJ0SDjScGb_LmhCVPs7gKPa8xgysdNpr1qeEA7uYJs32kwylDgmU1b\"}"}
{"level":"debug","ts":"2026-07-07T22:43:16Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"7a6ba944-2d29-40e4-92c2-3073e1641d0e","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-41e952.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"fedc55d3-34ed-43ea-ade3-6498d95bd74e","keyName":"e2e-rate-a-c80f64","subscription":"e2e-rate-iso-a-c80f64","tenant":"e2e-shared-a-41e952","userId":"fedc55d3-34ed-43ea-ade3-6498d95bd74e","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-07T22:43:16Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"7a6ba944-2d29-40e4-92c2-3073e1641d0e","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-41e952.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-41e952/rate-test-model-41e952\",\"requestedSubscription\":\"e2e-rate-iso-a-c80f64\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-07T22:43:16Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"7a6ba944-2d29-40e4-92c2-3073e1641d0e","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-41e952.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-41e952","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-c80f64","namespace":"ai-tenant-e2e-shared-a-41e952","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-07T22:43:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"7a6ba944-2d29-40e4-92c2-3073e1641d0e","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T22:43:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7a6ba944-2d29-40e4-92c2-3073e1641d0e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T22:43:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7a6ba944-2d29-40e4-92c2-3073e1641d0e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T22:43:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7a6ba944-2d29-40e4-92c2-3073e1641d0e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-41e952/rate-test-model-41e952\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T22:43:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7a6ba944-2d29-40e4-92c2-3073e1641d0e","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T22:43:16Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7a6ba944-2d29-40e4-92c2-3073e1641d0e","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T22:43:16Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7a6ba944-2d29-40e4-92c2-3073e1641d0e","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-c80f64"}
{"level":"debug","ts":"2026-07-07T22:43:16Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7a6ba944-2d29-40e4-92c2-3073e1641d0e","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T22:43:16Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7a6ba944-2d29-40e4-92c2-3073e1641d0e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"fedc55d3-34ed-43ea-ade3-6498d95bd74e","keyName":"e2e-rate-a-c80f64","selected_subscription":"e2e-rate-iso-a-c80f64","selected_subscription_key":"ai-tenant-e2e-shared-a-41e952/e2e-rate-iso-a-c80f64@ai-tenant-e2e-shared-a-41e952/rate-test-model-41e952","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-41e952","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-c80f64","namespace":"ai-tenant-e2e-shared-a-41e952","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-07T22:43:16Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7a6ba944-2d29-40e4-92c2-3073e1641d0e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T22:43:16Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7a6ba944-2d29-40e4-92c2-3073e1641d0e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T22:43:17Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"809bbf31-9018-450c-adfc-9bcf8fa6e505","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:44760","PortSpecifier":{"PortValue":44760}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.43:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"809bbf31-9018-450c-adfc-9bcf8fa6e505","method":"POST","path":"/ai-tenant-e2e-shared-a-41e952/rate-test-model-41e952/v1/completions","host":"e2e-shared-a-41e952.apps.c16f4dfd-eb23-495f-acc2-7352d9229b8d.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T22:43:17Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"809bbf31-9018-450c-adfc-9bcf8fa6e505","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:44760","PortSpecifier":{"PortValue":44760}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.43:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783464197,"nanos":66102135},"http":{"id":"809bbf31-9018-450c-adfc-9bcf8fa6e505","method":"POST","headers":{":authority":"e2e-shared-a-41e952.apps.c16f4dfd-eb23-495f-acc2-7352d9229b8d.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-41e952/rate-test-model-41e952/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T22:43:17Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"809bbf31-9018-450c-adfc-9bcf8fa6e505","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1Nx6Zk4OJ0SDjScGb_LmhCVPs7gKPa8xgysdNpr1qeEA7uYJs32kwylDgmU1b"}
{"level":"debug","ts":"2026-07-07T22:43:17Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"809bbf31-9018-450c-adfc-9bcf8fa6e505","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-41e952.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1Nx6Zk4OJ0SDjScGb_LmhCVPs7gKPa8xgysdNpr1qeEA7uYJs32kwylDgmU1b\"}"}
{"level":"debug","ts":"2026-07-07T22:43:17Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"809bbf31-9018-450c-adfc-9bcf8fa6e505","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-41e952.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"fedc55d3-34ed-43ea-ade3-6498d95bd74e","keyName":"e2e-rate-a-c80f64","subscription":"e2e-rate-iso-a-c80f64","tenant":"e2e-shared-a-41e952","userId":"fedc55d3-34ed-43ea-ade3-6498d95bd74e","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-07T22:43:17Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"809bbf31-9018-450c-adfc-9bcf8fa6e505","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-41e952.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-41e952/rate-test-model-41e952\",\"requestedSubscription\":\"e2e-rate-iso-a-c80f64\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-07T22:43:17Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"809bbf31-9018-450c-adfc-9bcf8fa6e505","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-41e952.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-41e952","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-c80f64","namespace":"ai-tenant-e2e-shared-a-41e952","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-07T22:43:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"809bbf31-9018-450c-adfc-9bcf8fa6e505","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T22:43:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"809bbf31-9018-450c-adfc-9bcf8fa6e505","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T22:43:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"809bbf31-9018-450c-adfc-9bcf8fa6e505","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T22:43:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"809bbf31-9018-450c-adfc-9bcf8fa6e505","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-41e952/rate-test-model-41e952\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T22:43:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"809bbf31-9018-450c-adfc-9bcf8fa6e505","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T22:43:17Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"809bbf31-9018-450c-adfc-9bcf8fa6e505","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T22:43:17Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"809bbf31-9018-450c-adfc-9bcf8fa6e505","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-c80f64"}
{"level":"debug","ts":"2026-07-07T22:43:17Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"809bbf31-9018-450c-adfc-9bcf8fa6e505","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T22:43:17Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"809bbf31-9018-450c-adfc-9bcf8fa6e505","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"fedc55d3-34ed-43ea-ade3-6498d95bd74e","keyName":"e2e-rate-a-c80f64","selected_subscription":"e2e-rate-iso-a-c80f64","selected_subscription_key":"ai-tenant-e2e-shared-a-41e952/e2e-rate-iso-a-c80f64@ai-tenant-e2e-shared-a-41e952/rate-test-model-41e952","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-41e952","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-c80f64","namespace":"ai-tenant-e2e-shared-a-41e952","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-07T22:43:17Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"809bbf31-9018-450c-adfc-9bcf8fa6e505","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T22:43:17Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"809bbf31-9018-450c-adfc-9bcf8fa6e505","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T22:43:18Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b3f0bcc5-edf1-4d44-94d4-7e1249a4b4cb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:44774","PortSpecifier":{"PortValue":44774}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.43:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b3f0bcc5-edf1-4d44-94d4-7e1249a4b4cb","method":"POST","path":"/ai-tenant-e2e-shared-a-41e952/rate-test-model-41e952/v1/completions","host":"e2e-shared-a-41e952.apps.c16f4dfd-eb23-495f-acc2-7352d9229b8d.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T22:43:18Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b3f0bcc5-edf1-4d44-94d4-7e1249a4b4cb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:44774","PortSpecifier":{"PortValue":44774}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.43:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783464198,"nanos":112336555},"http":{"id":"b3f0bcc5-edf1-4d44-94d4-7e1249a4b4cb","method":"POST","headers":{":authority":"e2e-shared-a-41e952.apps.c16f4dfd-eb23-495f-acc2-7352d9229b8d.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-41e952/rate-test-model-41e952/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T22:43:18Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b3f0bcc5-edf1-4d44-94d4-7e1249a4b4cb","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1Nx6Zk4OJ0SDjScGb_LmhCVPs7gKPa8xgysdNpr1qeEA7uYJs32kwylDgmU1b"}
{"level":"debug","ts":"2026-07-07T22:43:18Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b3f0bcc5-edf1-4d44-94d4-7e1249a4b4cb","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-41e952.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1Nx6Zk4OJ0SDjScGb_LmhCVPs7gKPa8xgysdNpr1qeEA7uYJs32kwylDgmU1b\"}"}
{"level":"debug","ts":"2026-07-07T22:43:18Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b3f0bcc5-edf1-4d44-94d4-7e1249a4b4cb","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-41e952.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"fedc55d3-34ed-43ea-ade3-6498d95bd74e","keyName":"e2e-rate-a-c80f64","subscription":"e2e-rate-iso-a-c80f64","tenant":"e2e-shared-a-41e952","userId":"fedc55d3-34ed-43ea-ade3-6498d95bd74e","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-07T22:43:18Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b3f0bcc5-edf1-4d44-94d4-7e1249a4b4cb","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-41e952.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-41e952/rate-test-model-41e952\",\"requestedSubscription\":\"e2e-rate-iso-a-c80f64\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-07T22:43:18Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b3f0bcc5-edf1-4d44-94d4-7e1249a4b4cb","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-41e952.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-41e952","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-c80f64","namespace":"ai-tenant-e2e-shared-a-41e952","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-07T22:43:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b3f0bcc5-edf1-4d44-94d4-7e1249a4b4cb","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T22:43:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b3f0bcc5-edf1-4d44-94d4-7e1249a4b4cb","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T22:43:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b3f0bcc5-edf1-4d44-94d4-7e1249a4b4cb","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T22:43:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b3f0bcc5-edf1-4d44-94d4-7e1249a4b4cb","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T22:43:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b3f0bcc5-edf1-4d44-94d4-7e1249a4b4cb","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-41e952/rate-test-model-41e952\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T22:43:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b3f0bcc5-edf1-4d44-94d4-7e1249a4b4cb","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T22:43:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b3f0bcc5-edf1-4d44-94d4-7e1249a4b4cb","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-c80f64"}
{"level":"debug","ts":"2026-07-07T22:43:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b3f0bcc5-edf1-4d44-94d4-7e1249a4b4cb","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T22:43:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b3f0bcc5-edf1-4d44-94d4-7e1249a4b4cb","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"fedc55d3-34ed-43ea-ade3-6498d95bd74e","keyName":"e2e-rate-a-c80f64","selected_subscription":"e2e-rate-iso-a-c80f64","selected_subscription_key":"ai-tenant-e2e-shared-a-41e952/e2e-rate-iso-a-c80f64@ai-tenant-e2e-shared-a-41e952/rate-test-model-41e952","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-41e952","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-c80f64","namespace":"ai-tenant-e2e-shared-a-41e952","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-07T22:43:18Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b3f0bcc5-edf1-4d44-94d4-7e1249a4b4cb","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T22:43:18Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b3f0bcc5-edf1-4d44-94d4-7e1249a4b4cb","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T22:43:26Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6281e94b-5f24-425e-9b7e-d5298377b88e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:35218","PortSpecifier":{"PortValue":35218}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.43:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6281e94b-5f24-425e-9b7e-d5298377b88e","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-41e952.apps.c16f4dfd-eb23-495f-acc2-7352d9229b8d.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T22:43:26Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6281e94b-5f24-425e-9b7e-d5298377b88e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:35218","PortSpecifier":{"PortValue":35218}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.43:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783464206,"nanos":727114458},"http":{"id":"6281e94b-5f24-425e-9b7e-d5298377b88e","method":"POST","headers":{":authority":"e2e-shared-a-41e952.apps.c16f4dfd-eb23-495f-acc2-7352d9229b8d.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T22:43:26Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"6281e94b-5f24-425e-9b7e-d5298377b88e","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T22:43:26Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6281e94b-5f24-425e-9b7e-d5298377b88e","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"bb4924e6-aa4e-47bc-bc23-287bb2409310","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=d20e4333-b741-405f-90ea-62e9cb59fc3b"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7352d9229b8d"]}}
{"level":"debug","ts":"2026-07-07T22:43:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6281e94b-5f24-425e-9b7e-d5298377b88e","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7352d9229b8d"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=d20e4333-b741-405f-90ea-62e9cb59fc3b"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"bb4924e6-aa4e-47bc-bc23-287bb2409310","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"9a8567710872db35882e39159253d625ee92e29486331d26f348f7d45fdc1a08"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.43:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-41e952.apps.c16f4dfd-eb23-495f-acc2-7352d9229b8d.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T22:43:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6281e94b-5f24-425e-9b7e-d5298377b88e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T22:43:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6281e94b-5f24-425e-9b7e-d5298377b88e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T22:43:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6281e94b-5f24-425e-9b7e-d5298377b88e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-41e952/rate-test-model-41e952\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T22:43:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"6281e94b-5f24-425e-9b7e-d5298377b88e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T22:43:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6281e94b-5f24-425e-9b7e-d5298377b88e","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T22:43:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6281e94b-5f24-425e-9b7e-d5298377b88e","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T22:43:26Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6281e94b-5f24-425e-9b7e-d5298377b88e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T22:43:26Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6281e94b-5f24-425e-9b7e-d5298377b88e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T22:43:26Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"330c9b50-e6b5-4cb4-b556-3ea66c667323","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:55130","PortSpecifier":{"PortValue":55130}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"330c9b50-e6b5-4cb4-b556-3ea66c667323","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-a4bfe6.apps.c16f4dfd-eb23-495f-acc2-7352d9229b8d.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T22:43:26Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"330c9b50-e6b5-4cb4-b556-3ea66c667323","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:55130","PortSpecifier":{"PortValue":55130}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783464206,"nanos":787457883},"http":{"id":"330c9b50-e6b5-4cb4-b556-3ea66c667323","method":"POST","headers":{":authority":"e2e-shared-b-a4bfe6.apps.c16f4dfd-eb23-495f-acc2-7352d9229b8d.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T22:43:26Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"330c9b50-e6b5-4cb4-b556-3ea66c667323","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T22:43:26Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"330c9b50-e6b5-4cb4-b556-3ea66c667323","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"bb4924e6-aa4e-47bc-bc23-287bb2409310","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=d20e4333-b741-405f-90ea-62e9cb59fc3b"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7352d9229b8d"]}}
{"level":"debug","ts":"2026-07-07T22:43:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"330c9b50-e6b5-4cb4-b556-3ea66c667323","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7352d9229b8d"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=d20e4333-b741-405f-90ea-62e9cb59fc3b"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"bb4924e6-aa4e-47bc-bc23-287bb2409310","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"eb6677a84f2011c8778e746156db2939d5a85331d1da5327e5a965925b8554bd"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.44:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-a4bfe6.apps.c16f4dfd-eb23-495f-acc2-7352d9229b8d.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T22:43:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"330c9b50-e6b5-4cb4-b556-3ea66c667323","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T22:43:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"330c9b50-e6b5-4cb4-b556-3ea66c667323","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T22:43:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"330c9b50-e6b5-4cb4-b556-3ea66c667323","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-a4bfe6/rate-test-model-a4bfe6\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T22:43:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"330c9b50-e6b5-4cb4-b556-3ea66c667323","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T22:43:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"330c9b50-e6b5-4cb4-b556-3ea66c667323","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T22:43:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"330c9b50-e6b5-4cb4-b556-3ea66c667323","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-07T22:43:26Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"330c9b50-e6b5-4cb4-b556-3ea66c667323","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T22:43:26Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"330c9b50-e6b5-4cb4-b556-3ea66c667323","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T22:43:26Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4c0f1b1d-51ad-4ea1-b7a2-3568e086c2dd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:35230","PortSpecifier":{"PortValue":35230}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.43:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"4c0f1b1d-51ad-4ea1-b7a2-3568e086c2dd","method":"POST","path":"/ai-tenant-e2e-shared-a-41e952/rate-test-model-41e952/v1/completions","host":"e2e-shared-a-41e952.apps.c16f4dfd-eb23-495f-acc2-7352d9229b8d.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T22:43:26Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4c0f1b1d-51ad-4ea1-b7a2-3568e086c2dd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:35230","PortSpecifier":{"PortValue":35230}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.43:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783464206,"nanos":826207331},"http":{"id":"4c0f1b1d-51ad-4ea1-b7a2-3568e086c2dd","method":"POST","headers":{":authority":"e2e-shared-a-41e952.apps.c16f4dfd-eb23-495f-acc2-7352d9229b8d.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-41e952/rate-test-model-41e952/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T22:43:26Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"4c0f1b1d-51ad-4ea1-b7a2-3568e086c2dd","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-KOdZmNj7UAsb1CO6_HVKrSgNGHLC02yeDmLsTEUu14JEh5uoOVxlWTmBh4dv"}
{"level":"debug","ts":"2026-07-07T22:43:26Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"4c0f1b1d-51ad-4ea1-b7a2-3568e086c2dd","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-41e952.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-KOdZmNj7UAsb1CO6_HVKrSgNGHLC02yeDmLsTEUu14JEh5uoOVxlWTmBh4dv\"}"}
{"level":"debug","ts":"2026-07-07T22:43:26Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"4c0f1b1d-51ad-4ea1-b7a2-3568e086c2dd","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-41e952.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"5beccaf4-9d7b-4cd8-a5ce-ecbd33867090","keyName":"e2e-rate-a-d3365b","subscription":"e2e-rate-iso-a-d3365b","tenant":"e2e-shared-a-41e952","userId":"5beccaf4-9d7b-4cd8-a5ce-ecbd33867090","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-07T22:43:26Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"4c0f1b1d-51ad-4ea1-b7a2-3568e086c2dd","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-41e952.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-41e952/rate-test-model-41e952\",\"requestedSubscription\":\"e2e-rate-iso-a-d3365b\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-07T22:43:26Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"4c0f1b1d-51ad-4ea1-b7a2-3568e086c2dd","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-41e952.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-41e952","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d3365b","namespace":"ai-tenant-e2e-shared-a-41e952","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-07T22:43:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"4c0f1b1d-51ad-4ea1-b7a2-3568e086c2dd","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T22:43:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4c0f1b1d-51ad-4ea1-b7a2-3568e086c2dd","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T22:43:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4c0f1b1d-51ad-4ea1-b7a2-3568e086c2dd","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T22:43:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4c0f1b1d-51ad-4ea1-b7a2-3568e086c2dd","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-41e952/rate-test-model-41e952\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T22:43:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4c0f1b1d-51ad-4ea1-b7a2-3568e086c2dd","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T22:43:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4c0f1b1d-51ad-4ea1-b7a2-3568e086c2dd","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-d3365b"}
{"level":"debug","ts":"2026-07-07T22:43:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4c0f1b1d-51ad-4ea1-b7a2-3568e086c2dd","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T22:43:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4c0f1b1d-51ad-4ea1-b7a2-3568e086c2dd","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T22:43:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4c0f1b1d-51ad-4ea1-b7a2-3568e086c2dd","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"5beccaf4-9d7b-4cd8-a5ce-ecbd33867090","keyName":"e2e-rate-a-d3365b","selected_subscription":"e2e-rate-iso-a-d3365b","selected_subscription_key":"ai-tenant-e2e-shared-a-41e952/e2e-rate-iso-a-d3365b@ai-tenant-e2e-shared-a-41e952/rate-test-model-41e952","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-41e952","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d3365b","namespace":"ai-tenant-e2e-shared-a-41e952","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-07T22:43:26Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4c0f1b1d-51ad-4ea1-b7a2-3568e086c2dd","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T22:43:26Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4c0f1b1d-51ad-4ea1-b7a2-3568e086c2dd","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T22:43:27Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3b2854ad-f7e9-4209-b0e6-7e171f6a68d3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:35246","PortSpecifier":{"PortValue":35246}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.43:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3b2854ad-f7e9-4209-b0e6-7e171f6a68d3","method":"POST","path":"/ai-tenant-e2e-shared-a-41e952/rate-test-model-41e952/v1/completions","host":"e2e-shared-a-41e952.apps.c16f4dfd-eb23-495f-acc2-7352d9229b8d.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T22:43:27Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3b2854ad-f7e9-4209-b0e6-7e171f6a68d3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:35246","PortSpecifier":{"PortValue":35246}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.43:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783464207,"nanos":863147454},"http":{"id":"3b2854ad-f7e9-4209-b0e6-7e171f6a68d3","method":"POST","headers":{":authority":"e2e-shared-a-41e952.apps.c16f4dfd-eb23-495f-acc2-7352d9229b8d.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-41e952/rate-test-model-41e952/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T22:43:27Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3b2854ad-f7e9-4209-b0e6-7e171f6a68d3","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-KOdZmNj7UAsb1CO6_HVKrSgNGHLC02yeDmLsTEUu14JEh5uoOVxlWTmBh4dv"}
{"level":"debug","ts":"2026-07-07T22:43:27Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3b2854ad-f7e9-4209-b0e6-7e171f6a68d3","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-41e952.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-KOdZmNj7UAsb1CO6_HVKrSgNGHLC02yeDmLsTEUu14JEh5uoOVxlWTmBh4dv\"}"}
{"level":"debug","ts":"2026-07-07T22:43:27Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3b2854ad-f7e9-4209-b0e6-7e171f6a68d3","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-41e952.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"5beccaf4-9d7b-4cd8-a5ce-ecbd33867090","keyName":"e2e-rate-a-d3365b","subscription":"e2e-rate-iso-a-d3365b","tenant":"e2e-shared-a-41e952","userId":"5beccaf4-9d7b-4cd8-a5ce-ecbd33867090","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-07T22:43:27Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3b2854ad-f7e9-4209-b0e6-7e171f6a68d3","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-41e952.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-41e952/rate-test-model-41e952\",\"requestedSubscription\":\"e2e-rate-iso-a-d3365b\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-07T22:43:27Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3b2854ad-f7e9-4209-b0e6-7e171f6a68d3","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-41e952.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-41e952","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d3365b","namespace":"ai-tenant-e2e-shared-a-41e952","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-07T22:43:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3b2854ad-f7e9-4209-b0e6-7e171f6a68d3","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T22:43:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3b2854ad-f7e9-4209-b0e6-7e171f6a68d3","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T22:43:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3b2854ad-f7e9-4209-b0e6-7e171f6a68d3","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T22:43:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3b2854ad-f7e9-4209-b0e6-7e171f6a68d3","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-41e952/rate-test-model-41e952\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T22:43:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3b2854ad-f7e9-4209-b0e6-7e171f6a68d3","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T22:43:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3b2854ad-f7e9-4209-b0e6-7e171f6a68d3","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T22:43:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3b2854ad-f7e9-4209-b0e6-7e171f6a68d3","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T22:43:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3b2854ad-f7e9-4209-b0e6-7e171f6a68d3","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-d3365b"}
{"level":"debug","ts":"2026-07-07T22:43:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3b2854ad-f7e9-4209-b0e6-7e171f6a68d3","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"5beccaf4-9d7b-4cd8-a5ce-ecbd33867090","keyName":"e2e-rate-a-d3365b","selected_subscription":"e2e-rate-iso-a-d3365b","selected_subscription_key":"ai-tenant-e2e-shared-a-41e952/e2e-rate-iso-a-d3365b@ai-tenant-e2e-shared-a-41e952/rate-test-model-41e952","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-41e952","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d3365b","namespace":"ai-tenant-e2e-shared-a-41e952","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-07T22:43:27Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3b2854ad-f7e9-4209-b0e6-7e171f6a68d3","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T22:43:27Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3b2854ad-f7e9-4209-b0e6-7e171f6a68d3","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T22:43:28Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"05de3150-3f62-43b3-bba5-029633336276","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:35256","PortSpecifier":{"PortValue":35256}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.43:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"05de3150-3f62-43b3-bba5-029633336276","method":"POST","path":"/ai-tenant-e2e-shared-a-41e952/rate-test-model-41e952/v1/completions","host":"e2e-shared-a-41e952.apps.c16f4dfd-eb23-495f-acc2-7352d9229b8d.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T22:43:28Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"05de3150-3f62-43b3-bba5-029633336276","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:35256","PortSpecifier":{"PortValue":35256}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.43:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783464208,"nanos":907709402},"http":{"id":"05de3150-3f62-43b3-bba5-029633336276","method":"POST","headers":{":authority":"e2e-shared-a-41e952.apps.c16f4dfd-eb23-495f-acc2-7352d9229b8d.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-41e952/rate-test-model-41e952/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T22:43:28Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"05de3150-3f62-43b3-bba5-029633336276","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-KOdZmNj7UAsb1CO6_HVKrSgNGHLC02yeDmLsTEUu14JEh5uoOVxlWTmBh4dv"}
{"level":"debug","ts":"2026-07-07T22:43:28Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"05de3150-3f62-43b3-bba5-029633336276","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-41e952.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-KOdZmNj7UAsb1CO6_HVKrSgNGHLC02yeDmLsTEUu14JEh5uoOVxlWTmBh4dv\"}"}
{"level":"debug","ts":"2026-07-07T22:43:28Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"05de3150-3f62-43b3-bba5-029633336276","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-41e952.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"5beccaf4-9d7b-4cd8-a5ce-ecbd33867090","keyName":"e2e-rate-a-d3365b","subscription":"e2e-rate-iso-a-d3365b","tenant":"e2e-shared-a-41e952","userId":"5beccaf4-9d7b-4cd8-a5ce-ecbd33867090","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-07T22:43:28Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"05de3150-3f62-43b3-bba5-029633336276","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-41e952.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-41e952/rate-test-model-41e952\",\"requestedSubscription\":\"e2e-rate-iso-a-d3365b\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-07T22:43:28Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"05de3150-3f62-43b3-bba5-029633336276","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-41e952.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-41e952","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d3365b","namespace":"ai-tenant-e2e-shared-a-41e952","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-07T22:43:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"05de3150-3f62-43b3-bba5-029633336276","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T22:43:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"05de3150-3f62-43b3-bba5-029633336276","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T22:43:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"05de3150-3f62-43b3-bba5-029633336276","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T22:43:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"05de3150-3f62-43b3-bba5-029633336276","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T22:43:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"05de3150-3f62-43b3-bba5-029633336276","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-41e952/rate-test-model-41e952\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T22:43:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"05de3150-3f62-43b3-bba5-029633336276","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T22:43:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"05de3150-3f62-43b3-bba5-029633336276","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-d3365b"}
{"level":"debug","ts":"2026-07-07T22:43:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"05de3150-3f62-43b3-bba5-029633336276","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T22:43:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"05de3150-3f62-43b3-bba5-029633336276","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"5beccaf4-9d7b-4cd8-a5ce-ecbd33867090","keyName":"e2e-rate-a-d3365b","selected_subscription":"e2e-rate-iso-a-d3365b","selected_subscription_key":"ai-tenant-e2e-shared-a-41e952/e2e-rate-iso-a-d3365b@ai-tenant-e2e-shared-a-41e952/rate-test-model-41e952","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-41e952","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d3365b","namespace":"ai-tenant-e2e-shared-a-41e952","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-07T22:43:28Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"05de3150-3f62-43b3-bba5-029633336276","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T22:43:28Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"05de3150-3f62-43b3-bba5-029633336276","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T22:43:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"234c5135-f75c-4d99-84a4-0121a29fc669","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:35264","PortSpecifier":{"PortValue":35264}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.43:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"234c5135-f75c-4d99-84a4-0121a29fc669","method":"POST","path":"/ai-tenant-e2e-shared-a-41e952/rate-test-model-41e952/v1/completions","host":"e2e-shared-a-41e952.apps.c16f4dfd-eb23-495f-acc2-7352d9229b8d.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T22:43:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"234c5135-f75c-4d99-84a4-0121a29fc669","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:35264","PortSpecifier":{"PortValue":35264}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.43:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783464209,"nanos":943054526},"http":{"id":"234c5135-f75c-4d99-84a4-0121a29fc669","method":"POST","headers":{":authority":"e2e-shared-a-41e952.apps.c16f4dfd-eb23-495f-acc2-7352d9229b8d.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-41e952/rate-test-model-41e952/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T22:43:29Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"234c5135-f75c-4d99-84a4-0121a29fc669","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-KOdZmNj7UAsb1CO6_HVKrSgNGHLC02yeDmLsTEUu14JEh5uoOVxlWTmBh4dv"}
{"level":"debug","ts":"2026-07-07T22:43:29Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"234c5135-f75c-4d99-84a4-0121a29fc669","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-41e952.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-KOdZmNj7UAsb1CO6_HVKrSgNGHLC02yeDmLsTEUu14JEh5uoOVxlWTmBh4dv\"}"}
{"level":"debug","ts":"2026-07-07T22:43:29Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"234c5135-f75c-4d99-84a4-0121a29fc669","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-41e952.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"5beccaf4-9d7b-4cd8-a5ce-ecbd33867090","keyName":"e2e-rate-a-d3365b","subscription":"e2e-rate-iso-a-d3365b","tenant":"e2e-shared-a-41e952","userId":"5beccaf4-9d7b-4cd8-a5ce-ecbd33867090","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-07T22:43:29Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"234c5135-f75c-4d99-84a4-0121a29fc669","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-41e952.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-41e952/rate-test-model-41e952\",\"requestedSubscription\":\"e2e-rate-iso-a-d3365b\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-07T22:43:29Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"234c5135-f75c-4d99-84a4-0121a29fc669","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-41e952.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-41e952","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d3365b","namespace":"ai-tenant-e2e-shared-a-41e952","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-07T22:43:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"234c5135-f75c-4d99-84a4-0121a29fc669","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T22:43:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"234c5135-f75c-4d99-84a4-0121a29fc669","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T22:43:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"234c5135-f75c-4d99-84a4-0121a29fc669","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T22:43:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"234c5135-f75c-4d99-84a4-0121a29fc669","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-41e952/rate-test-model-41e952\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T22:43:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"234c5135-f75c-4d99-84a4-0121a29fc669","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T22:43:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"234c5135-f75c-4d99-84a4-0121a29fc669","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T22:43:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"234c5135-f75c-4d99-84a4-0121a29fc669","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T22:43:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"234c5135-f75c-4d99-84a4-0121a29fc669","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-d3365b"}
{"level":"debug","ts":"2026-07-07T22:43:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"234c5135-f75c-4d99-84a4-0121a29fc669","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"5beccaf4-9d7b-4cd8-a5ce-ecbd33867090","keyName":"e2e-rate-a-d3365b","selected_subscription":"e2e-rate-iso-a-d3365b","selected_subscription_key":"ai-tenant-e2e-shared-a-41e952/e2e-rate-iso-a-d3365b@ai-tenant-e2e-shared-a-41e952/rate-test-model-41e952","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-41e952","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d3365b","namespace":"ai-tenant-e2e-shared-a-41e952","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-07T22:43:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"234c5135-f75c-4d99-84a4-0121a29fc669","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T22:43:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"234c5135-f75c-4d99-84a4-0121a29fc669","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T22:43:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9141d183-a0c8-4527-bd09-9a514c7940e4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:35270","PortSpecifier":{"PortValue":35270}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.43:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9141d183-a0c8-4527-bd09-9a514c7940e4","method":"POST","path":"/ai-tenant-e2e-shared-a-41e952/rate-test-model-41e952/v1/completions","host":"e2e-shared-a-41e952.apps.c16f4dfd-eb23-495f-acc2-7352d9229b8d.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T22:43:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9141d183-a0c8-4527-bd09-9a514c7940e4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:35270","PortSpecifier":{"PortValue":35270}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.43:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783464210,"nanos":977523454},"http":{"id":"9141d183-a0c8-4527-bd09-9a514c7940e4","method":"POST","headers":{":authority":"e2e-shared-a-41e952.apps.c16f4dfd-eb23-495f-acc2-7352d9229b8d.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-41e952/rate-test-model-41e952/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T22:43:30Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9141d183-a0c8-4527-bd09-9a514c7940e4","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-KOdZmNj7UAsb1CO6_HVKrSgNGHLC02yeDmLsTEUu14JEh5uoOVxlWTmBh4dv"}
{"level":"debug","ts":"2026-07-07T22:43:30Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9141d183-a0c8-4527-bd09-9a514c7940e4","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-41e952.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-KOdZmNj7UAsb1CO6_HVKrSgNGHLC02yeDmLsTEUu14JEh5uoOVxlWTmBh4dv\"}"}
{"level":"debug","ts":"2026-07-07T22:43:30Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9141d183-a0c8-4527-bd09-9a514c7940e4","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-41e952.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"5beccaf4-9d7b-4cd8-a5ce-ecbd33867090","keyName":"e2e-rate-a-d3365b","subscription":"e2e-rate-iso-a-d3365b","tenant":"e2e-shared-a-41e952","userId":"5beccaf4-9d7b-4cd8-a5ce-ecbd33867090","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-07T22:43:30Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9141d183-a0c8-4527-bd09-9a514c7940e4","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-41e952.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-41e952/rate-test-model-41e952\",\"requestedSubscription\":\"e2e-rate-iso-a-d3365b\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-07T22:43:30Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9141d183-a0c8-4527-bd09-9a514c7940e4","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-41e952.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-41e952","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d3365b","namespace":"ai-tenant-e2e-shared-a-41e952","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-07T22:43:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9141d183-a0c8-4527-bd09-9a514c7940e4","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T22:43:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9141d183-a0c8-4527-bd09-9a514c7940e4","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T22:43:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9141d183-a0c8-4527-bd09-9a514c7940e4","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T22:43:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9141d183-a0c8-4527-bd09-9a514c7940e4","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T22:43:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9141d183-a0c8-4527-bd09-9a514c7940e4","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-41e952/rate-test-model-41e952\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T22:43:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9141d183-a0c8-4527-bd09-9a514c7940e4","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T22:43:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9141d183-a0c8-4527-bd09-9a514c7940e4","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T22:43:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9141d183-a0c8-4527-bd09-9a514c7940e4","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-d3365b"}
{"level":"debug","ts":"2026-07-07T22:43:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9141d183-a0c8-4527-bd09-9a514c7940e4","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"5beccaf4-9d7b-4cd8-a5ce-ecbd33867090","keyName":"e2e-rate-a-d3365b","selected_subscription":"e2e-rate-iso-a-d3365b","selected_subscription_key":"ai-tenant-e2e-shared-a-41e952/e2e-rate-iso-a-d3365b@ai-tenant-e2e-shared-a-41e952/rate-test-model-41e952","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-41e952","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d3365b","namespace":"ai-tenant-e2e-shared-a-41e952","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-07T22:43:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9141d183-a0c8-4527-bd09-9a514c7940e4","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T22:43:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9141d183-a0c8-4527-bd09-9a514c7940e4","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T22:43:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e99211c8-ab4e-4bf9-9f20-903c024fac20","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:35280","PortSpecifier":{"PortValue":35280}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.43:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e99211c8-ab4e-4bf9-9f20-903c024fac20","method":"POST","path":"/ai-tenant-e2e-shared-a-41e952/rate-test-model-41e952/v1/completions","host":"e2e-shared-a-41e952.apps.c16f4dfd-eb23-495f-acc2-7352d9229b8d.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T22:43:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e99211c8-ab4e-4bf9-9f20-903c024fac20","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:35280","PortSpecifier":{"PortValue":35280}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.43:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783464212,"nanos":11334612},"http":{"id":"e99211c8-ab4e-4bf9-9f20-903c024fac20","method":"POST","headers":{":authority":"e2e-shared-a-41e952.apps.c16f4dfd-eb23-495f-acc2-7352d9229b8d.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-41e952/rate-test-model-41e952/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T22:43:32Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e99211c8-ab4e-4bf9-9f20-903c024fac20","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-KOdZmNj7UAsb1CO6_HVKrSgNGHLC02yeDmLsTEUu14JEh5uoOVxlWTmBh4dv"}
{"level":"debug","ts":"2026-07-07T22:43:32Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e99211c8-ab4e-4bf9-9f20-903c024fac20","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-41e952.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-KOdZmNj7UAsb1CO6_HVKrSgNGHLC02yeDmLsTEUu14JEh5uoOVxlWTmBh4dv\"}"}
{"level":"debug","ts":"2026-07-07T22:43:32Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e99211c8-ab4e-4bf9-9f20-903c024fac20","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-41e952.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"5beccaf4-9d7b-4cd8-a5ce-ecbd33867090","keyName":"e2e-rate-a-d3365b","subscription":"e2e-rate-iso-a-d3365b","tenant":"e2e-shared-a-41e952","userId":"5beccaf4-9d7b-4cd8-a5ce-ecbd33867090","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-07T22:43:32Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e99211c8-ab4e-4bf9-9f20-903c024fac20","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-41e952.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-41e952/rate-test-model-41e952\",\"requestedSubscription\":\"e2e-rate-iso-a-d3365b\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-07T22:43:32Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e99211c8-ab4e-4bf9-9f20-903c024fac20","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-41e952.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-41e952","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d3365b","namespace":"ai-tenant-e2e-shared-a-41e952","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-07T22:43:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e99211c8-ab4e-4bf9-9f20-903c024fac20","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T22:43:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e99211c8-ab4e-4bf9-9f20-903c024fac20","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T22:43:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e99211c8-ab4e-4bf9-9f20-903c024fac20","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T22:43:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e99211c8-ab4e-4bf9-9f20-903c024fac20","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T22:43:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e99211c8-ab4e-4bf9-9f20-903c024fac20","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-41e952/rate-test-model-41e952\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T22:43:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e99211c8-ab4e-4bf9-9f20-903c024fac20","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T22:43:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e99211c8-ab4e-4bf9-9f20-903c024fac20","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T22:43:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e99211c8-ab4e-4bf9-9f20-903c024fac20","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-d3365b"}
{"level":"debug","ts":"2026-07-07T22:43:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e99211c8-ab4e-4bf9-9f20-903c024fac20","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"5beccaf4-9d7b-4cd8-a5ce-ecbd33867090","keyName":"e2e-rate-a-d3365b","selected_subscription":"e2e-rate-iso-a-d3365b","selected_subscription_key":"ai-tenant-e2e-shared-a-41e952/e2e-rate-iso-a-d3365b@ai-tenant-e2e-shared-a-41e952/rate-test-model-41e952","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-41e952","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d3365b","namespace":"ai-tenant-e2e-shared-a-41e952","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-07T22:43:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e99211c8-ab4e-4bf9-9f20-903c024fac20","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T22:43:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e99211c8-ab4e-4bf9-9f20-903c024fac20","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T22:43:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9a931735-a706-473c-bf1b-9032c1e4c636","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:55144","PortSpecifier":{"PortValue":55144}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9a931735-a706-473c-bf1b-9032c1e4c636","method":"POST","path":"/ai-tenant-e2e-shared-b-a4bfe6/rate-test-model-a4bfe6/v1/completions","host":"e2e-shared-b-a4bfe6.apps.c16f4dfd-eb23-495f-acc2-7352d9229b8d.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T22:43:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9a931735-a706-473c-bf1b-9032c1e4c636","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:55144","PortSpecifier":{"PortValue":55144}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783464212,"nanos":49907561},"http":{"id":"9a931735-a706-473c-bf1b-9032c1e4c636","method":"POST","headers":{":authority":"e2e-shared-b-a4bfe6.apps.c16f4dfd-eb23-495f-acc2-7352d9229b8d.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-a4bfe6/rate-test-model-a4bfe6/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T22:43:32Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9a931735-a706-473c-bf1b-9032c1e4c636","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1K0MH6m0zh0Kdi4TI_fVenZ3pWEU4elpEnsXFwFkOCOS0JYoFg8nswOUxxDQU"}
{"level":"debug","ts":"2026-07-07T22:43:32Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9a931735-a706-473c-bf1b-9032c1e4c636","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-a4bfe6.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1K0MH6m0zh0Kdi4TI_fVenZ3pWEU4elpEnsXFwFkOCOS0JYoFg8nswOUxxDQU\"}"}
{"level":"debug","ts":"2026-07-07T22:43:32Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9a931735-a706-473c-bf1b-9032c1e4c636","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-a4bfe6.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"9d44fa5c-eeed-4dbb-9cf3-a78a35bf8b71","keyName":"e2e-rate-b-d3365b","subscription":"e2e-rate-iso-b-d3365b","tenant":"e2e-shared-b-a4bfe6","userId":"9d44fa5c-eeed-4dbb-9cf3-a78a35bf8b71","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-07T22:43:32Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9a931735-a706-473c-bf1b-9032c1e4c636","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-a4bfe6.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-a4bfe6/rate-test-model-a4bfe6\",\"requestedSubscription\":\"e2e-rate-iso-b-d3365b\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-07T22:43:32Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9a931735-a706-473c-bf1b-9032c1e4c636","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-a4bfe6.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-a4bfe6","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-d3365b","namespace":"ai-tenant-e2e-shared-b-a4bfe6","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-07T22:43:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9a931735-a706-473c-bf1b-9032c1e4c636","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T22:43:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9a931735-a706-473c-bf1b-9032c1e4c636","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T22:43:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9a931735-a706-473c-bf1b-9032c1e4c636","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-a4bfe6/rate-test-model-a4bfe6\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T22:43:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9a931735-a706-473c-bf1b-9032c1e4c636","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T22:43:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9a931735-a706-473c-bf1b-9032c1e4c636","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T22:43:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9a931735-a706-473c-bf1b-9032c1e4c636","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T22:43:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9a931735-a706-473c-bf1b-9032c1e4c636","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-d3365b"}
{"level":"debug","ts":"2026-07-07T22:43:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9a931735-a706-473c-bf1b-9032c1e4c636","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T22:43:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9a931735-a706-473c-bf1b-9032c1e4c636","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"9d44fa5c-eeed-4dbb-9cf3-a78a35bf8b71","keyName":"e2e-rate-b-d3365b","selected_subscription":"e2e-rate-iso-b-d3365b","selected_subscription_key":"ai-tenant-e2e-shared-b-a4bfe6/e2e-rate-iso-b-d3365b@ai-tenant-e2e-shared-b-a4bfe6/rate-test-model-a4bfe6","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-a4bfe6","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-d3365b","namespace":"ai-tenant-e2e-shared-b-a4bfe6","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-07T22:43:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9a931735-a706-473c-bf1b-9032c1e4c636","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T22:43:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9a931735-a706-473c-bf1b-9032c1e4c636","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T22:43:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/30f3319f99a8abd4eba8f1598ca6b939fa1b069577f1a85b7e722fbad99457bf"}
{"level":"info","ts":"2026-07-07T22:43:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9e5d92dee0f169f3c6d564d220aea73e8b166cb0ad6e1dfca1f360493d80910f"}
{"level":"info","ts":"2026-07-07T22:43:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/5868fbcf0daf8e82f1266b1d5366d560f4633a34faf9b7ab370d5af47c36faa3"}
{"level":"info","ts":"2026-07-07T22:43:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/46535d5626a9121dcfac45ac163c65091295792bc0373b29a305c648bc49c9d6"}
{"level":"info","ts":"2026-07-07T22:43:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/8ce83f609dcfe400b54e0a76c4a85fda2b09af080d7d4474d301a28676264cf7"}
{"level":"info","ts":"2026-07-07T22:43:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/87bf5b8955ff4146107c38fa804a280767b67ff65bf70de5c51a191288803ad3"}
{"level":"info","ts":"2026-07-07T22:43:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9d0d328281b4681d88231fd47e645d36ae8266b1e354668f94c480d583ce3c79"}
{"level":"info","ts":"2026-07-07T22:43:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/fa4fc8fb726ee2ddf777caa45c4f01ba8122a2fd27f6dcfb61f20c732b4ca4ed"}
{"level":"info","ts":"2026-07-07T22:43:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c029c45bc858b1ee6f98e11cc3dfd00592a5a63edaff2871468acb37bb074b63"}
{"level":"info","ts":"2026-07-07T22:43:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/37c848544fbf721a00bd83a4cbf714a418c37835955df6db151199ad83b3b33d"}
{"level":"info","ts":"2026-07-07T22:43:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/efdbf10809a7d7c6aca941ce300d15bb7c1059debc608dc578e3745597be4d6c"}
{"level":"info","ts":"2026-07-07T22:43:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2bcb797645fe5e47cd6e2885312f786747d66763e405987d9dda625f3038904e"}
{"level":"info","ts":"2026-07-07T22:43:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9f495b00a13ca18a774cc8756429484a6789dee774595fe4fb9e2ce95a125d3e"}
{"level":"info","ts":"2026-07-07T22:43:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/fb9f3794828bc493dd23d246d4f008fa508f782d8f0494e7bfd35c2bdfb4ecc8"}
{"level":"info","ts":"2026-07-07T22:43:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/915cd1c390dc31ed035f8a8efd60dc86c2c462f873e58636b566b3f80e68c715"}
{"level":"info","ts":"2026-07-07T22:43:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2b629cfd64cae59244768bdc9e5f6a6a35bee33e9a112db902b74acd1fbcc764"}
{"level":"info","ts":"2026-07-07T22:43:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3d38fbf2c5357d325a382939175e7bc43b30a9f696bb0c7249dc1bbf43a6ca5a"}
{"level":"info","ts":"2026-07-07T22:43:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9a8567710872db35882e39159253d625ee92e29486331d26f348f7d45fdc1a08"}
{"level":"info","ts":"2026-07-07T22:44:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/eb6677a84f2011c8778e746156db2939d5a85331d1da5327e5a965925b8554bd"}
{"level":"info","ts":"2026-07-07T22:44:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4a381ef84795049e53ccfc27eaf9e3cb72f34c5e61e5932e68dbcdc29b57ed81"}