--- Authorino logs from kuadrant-system (label=authorino-resource=authorino) ---
{"level":"debug","ts":"2026-07-09T18:09:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8b6b7dd0b6e1dc7029af5cf5c21e7d989fac1276a2f7348b1c87e0594006419b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8b6b7dd0b6e1dc7029af5cf5c21e7d989fac1276a2f7348b1c87e0594006419b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:09:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8b6b7dd0b6e1dc7029af5cf5c21e7d989fac1276a2f7348b1c87e0594006419b"}
{"level":"debug","ts":"2026-07-09T18:09:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b17b0af69100dc17ef560fa9ec51a1844291638fd4411e5a22ffee10ad16ebae","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:09:48Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:09:48Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:09:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6fff71fcd45a294412257cdd7721672479b46bddf883bead293812798aca2799"}
{"level":"info","ts":"2026-07-09T18:09:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b17b0af69100dc17ef560fa9ec51a1844291638fd4411e5a22ffee10ad16ebae","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8b6b7dd0b6e1dc7029af5cf5c21e7d989fac1276a2f7348b1c87e0594006419b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b17b0af69100dc17ef560fa9ec51a1844291638fd4411e5a22ffee10ad16ebae","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b17b0af69100dc17ef560fa9ec51a1844291638fd4411e5a22ffee10ad16ebae","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:09:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8b6b7dd0b6e1dc7029af5cf5c21e7d989fac1276a2f7348b1c87e0594006419b"}
{"level":"debug","ts":"2026-07-09T18:09:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b17b0af69100dc17ef560fa9ec51a1844291638fd4411e5a22ffee10ad16ebae","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:09:48Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:09:48Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:09:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b17b0af69100dc17ef560fa9ec51a1844291638fd4411e5a22ffee10ad16ebae"}
{"level":"info","ts":"2026-07-09T18:09:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b17b0af69100dc17ef560fa9ec51a1844291638fd4411e5a22ffee10ad16ebae","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8b6b7dd0b6e1dc7029af5cf5c21e7d989fac1276a2f7348b1c87e0594006419b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:09:48Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:09:48Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8b6b7dd0b6e1dc7029af5cf5c21e7d989fac1276a2f7348b1c87e0594006419b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:09:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8b6b7dd0b6e1dc7029af5cf5c21e7d989fac1276a2f7348b1c87e0594006419b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b17b0af69100dc17ef560fa9ec51a1844291638fd4411e5a22ffee10ad16ebae","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8b6b7dd0b6e1dc7029af5cf5c21e7d989fac1276a2f7348b1c87e0594006419b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:09:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b17b0af69100dc17ef560fa9ec51a1844291638fd4411e5a22ffee10ad16ebae"}
{"level":"debug","ts":"2026-07-09T18:09:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b17b0af69100dc17ef560fa9ec51a1844291638fd4411e5a22ffee10ad16ebae","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:09:48Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:09:48Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b17b0af69100dc17ef560fa9ec51a1844291638fd4411e5a22ffee10ad16ebae"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:09:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8b6b7dd0b6e1dc7029af5cf5c21e7d989fac1276a2f7348b1c87e0594006419b"}
{"level":"info","ts":"2026-07-09T18:09:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b17b0af69100dc17ef560fa9ec51a1844291638fd4411e5a22ffee10ad16ebae","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b17b0af69100dc17ef560fa9ec51a1844291638fd4411e5a22ffee10ad16ebae","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:09:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b17b0af69100dc17ef560fa9ec51a1844291638fd4411e5a22ffee10ad16ebae"}
{"level":"debug","ts":"2026-07-09T18:09:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d0dc982a4b2bb71b26b48cdc76131f83b5c5ef6691a5682c984d9c772913a6de","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:09:48Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:09:48Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:09:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d0dc982a4b2bb71b26b48cdc76131f83b5c5ef6691a5682c984d9c772913a6de","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1075f105d49b12efae941268860f7accaefab84c9f72c3aeae11d7dd6353ed60","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:09:48Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:09:48Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:09:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d0dc982a4b2bb71b26b48cdc76131f83b5c5ef6691a5682c984d9c772913a6de"}
{"level":"info","ts":"2026-07-09T18:09:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1075f105d49b12efae941268860f7accaefab84c9f72c3aeae11d7dd6353ed60","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d0dc982a4b2bb71b26b48cdc76131f83b5c5ef6691a5682c984d9c772913a6de","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:09:48Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:09:48Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d0dc982a4b2bb71b26b48cdc76131f83b5c5ef6691a5682c984d9c772913a6de"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:09:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1075f105d49b12efae941268860f7accaefab84c9f72c3aeae11d7dd6353ed60"}
{"level":"info","ts":"2026-07-09T18:09:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d0dc982a4b2bb71b26b48cdc76131f83b5c5ef6691a5682c984d9c772913a6de","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1075f105d49b12efae941268860f7accaefab84c9f72c3aeae11d7dd6353ed60","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:09:48Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:09:48Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1075f105d49b12efae941268860f7accaefab84c9f72c3aeae11d7dd6353ed60"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:09:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1075f105d49b12efae941268860f7accaefab84c9f72c3aeae11d7dd6353ed60","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d0dc982a4b2bb71b26b48cdc76131f83b5c5ef6691a5682c984d9c772913a6de","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:09:48Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:09:48Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:09:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d0dc982a4b2bb71b26b48cdc76131f83b5c5ef6691a5682c984d9c772913a6de"}
{"level":"info","ts":"2026-07-09T18:09:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d0dc982a4b2bb71b26b48cdc76131f83b5c5ef6691a5682c984d9c772913a6de","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1075f105d49b12efae941268860f7accaefab84c9f72c3aeae11d7dd6353ed60","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:09:48Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:09:48Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:09:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1075f105d49b12efae941268860f7accaefab84c9f72c3aeae11d7dd6353ed60"}
{"level":"info","ts":"2026-07-09T18:09:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1075f105d49b12efae941268860f7accaefab84c9f72c3aeae11d7dd6353ed60","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d0dc982a4b2bb71b26b48cdc76131f83b5c5ef6691a5682c984d9c772913a6de","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1075f105d49b12efae941268860f7accaefab84c9f72c3aeae11d7dd6353ed60","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:09:48Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:09:48Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1075f105d49b12efae941268860f7accaefab84c9f72c3aeae11d7dd6353ed60"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:09:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1075f105d49b12efae941268860f7accaefab84c9f72c3aeae11d7dd6353ed60","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d0dc982a4b2bb71b26b48cdc76131f83b5c5ef6691a5682c984d9c772913a6de","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9b729fee5f198546b25447d43f6aac3c5d2da0ab25e3729b865bc3257e29673a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:09:48Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:09:48Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:09:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d0dc982a4b2bb71b26b48cdc76131f83b5c5ef6691a5682c984d9c772913a6de"}
{"level":"info","ts":"2026-07-09T18:09:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9b729fee5f198546b25447d43f6aac3c5d2da0ab25e3729b865bc3257e29673a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1075f105d49b12efae941268860f7accaefab84c9f72c3aeae11d7dd6353ed60","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:09:48Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:09:48Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:09:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1075f105d49b12efae941268860f7accaefab84c9f72c3aeae11d7dd6353ed60"}
{"level":"info","ts":"2026-07-09T18:09:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1075f105d49b12efae941268860f7accaefab84c9f72c3aeae11d7dd6353ed60","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"16ebaa544860fe8206916bd2ea5a46ae07b07ff6683dac169c4d5816253fb033","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:09:48Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:09:48Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:09:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"16ebaa544860fe8206916bd2ea5a46ae07b07ff6683dac169c4d5816253fb033","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9b729fee5f198546b25447d43f6aac3c5d2da0ab25e3729b865bc3257e29673a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:09:48Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:09:48Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:09:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9b729fee5f198546b25447d43f6aac3c5d2da0ab25e3729b865bc3257e29673a"}
{"level":"info","ts":"2026-07-09T18:09:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9b729fee5f198546b25447d43f6aac3c5d2da0ab25e3729b865bc3257e29673a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d0dc982a4b2bb71b26b48cdc76131f83b5c5ef6691a5682c984d9c772913a6de","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:09:48Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:09:48Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d0dc982a4b2bb71b26b48cdc76131f83b5c5ef6691a5682c984d9c772913a6de"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:09:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/16ebaa544860fe8206916bd2ea5a46ae07b07ff6683dac169c4d5816253fb033"}
{"level":"info","ts":"2026-07-09T18:09:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d0dc982a4b2bb71b26b48cdc76131f83b5c5ef6691a5682c984d9c772913a6de","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1075f105d49b12efae941268860f7accaefab84c9f72c3aeae11d7dd6353ed60","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"16ebaa544860fe8206916bd2ea5a46ae07b07ff6683dac169c4d5816253fb033","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:09:49Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:09:49Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["16ebaa544860fe8206916bd2ea5a46ae07b07ff6683dac169c4d5816253fb033"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:09:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1075f105d49b12efae941268860f7accaefab84c9f72c3aeae11d7dd6353ed60"}
{"level":"info","ts":"2026-07-09T18:09:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"16ebaa544860fe8206916bd2ea5a46ae07b07ff6683dac169c4d5816253fb033","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9b729fee5f198546b25447d43f6aac3c5d2da0ab25e3729b865bc3257e29673a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d0dc982a4b2bb71b26b48cdc76131f83b5c5ef6691a5682c984d9c772913a6de","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1075f105d49b12efae941268860f7accaefab84c9f72c3aeae11d7dd6353ed60","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:09:49Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:09:49Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1075f105d49b12efae941268860f7accaefab84c9f72c3aeae11d7dd6353ed60"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:09:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1075f105d49b12efae941268860f7accaefab84c9f72c3aeae11d7dd6353ed60","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"16ebaa544860fe8206916bd2ea5a46ae07b07ff6683dac169c4d5816253fb033","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6ee14c9a53dc59919e28b7773ad6206643890488615762489970584fb5b8cebc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:09:49Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:09:49Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:09:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9b729fee5f198546b25447d43f6aac3c5d2da0ab25e3729b865bc3257e29673a"}
{"level":"info","ts":"2026-07-09T18:09:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6ee14c9a53dc59919e28b7773ad6206643890488615762489970584fb5b8cebc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1075f105d49b12efae941268860f7accaefab84c9f72c3aeae11d7dd6353ed60","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9b729fee5f198546b25447d43f6aac3c5d2da0ab25e3729b865bc3257e29673a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:09:49Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:09:49Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9b729fee5f198546b25447d43f6aac3c5d2da0ab25e3729b865bc3257e29673a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:09:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9b729fee5f198546b25447d43f6aac3c5d2da0ab25e3729b865bc3257e29673a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6ee14c9a53dc59919e28b7773ad6206643890488615762489970584fb5b8cebc","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:09:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d0dc982a4b2bb71b26b48cdc76131f83b5c5ef6691a5682c984d9c772913a6de"}
{"level":"debug","ts":"2026-07-09T18:09:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9b729fee5f198546b25447d43f6aac3c5d2da0ab25e3729b865bc3257e29673a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6ee14c9a53dc59919e28b7773ad6206643890488615762489970584fb5b8cebc","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:09:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/16ebaa544860fe8206916bd2ea5a46ae07b07ff6683dac169c4d5816253fb033"}
{"level":"debug","ts":"2026-07-09T18:09:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6ee14c9a53dc59919e28b7773ad6206643890488615762489970584fb5b8cebc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:09:49Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:09:49Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:09:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6ee14c9a53dc59919e28b7773ad6206643890488615762489970584fb5b8cebc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6ee14c9a53dc59919e28b7773ad6206643890488615762489970584fb5b8cebc","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:09:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6ee14c9a53dc59919e28b7773ad6206643890488615762489970584fb5b8cebc"}
{"level":"debug","ts":"2026-07-09T18:09:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"da41b07f92d255d3238b29ad30df8c0ee8a4fe5642aa41d9956e7ed89f5cb3bc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:09:49Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:09:49Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:09:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"da41b07f92d255d3238b29ad30df8c0ee8a4fe5642aa41d9956e7ed89f5cb3bc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6ee14c9a53dc59919e28b7773ad6206643890488615762489970584fb5b8cebc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:09:49Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:09:49Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["6ee14c9a53dc59919e28b7773ad6206643890488615762489970584fb5b8cebc"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:09:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1075f105d49b12efae941268860f7accaefab84c9f72c3aeae11d7dd6353ed60"}
{"level":"info","ts":"2026-07-09T18:09:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6ee14c9a53dc59919e28b7773ad6206643890488615762489970584fb5b8cebc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"da41b07f92d255d3238b29ad30df8c0ee8a4fe5642aa41d9956e7ed89f5cb3bc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6ee14c9a53dc59919e28b7773ad6206643890488615762489970584fb5b8cebc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"da41b07f92d255d3238b29ad30df8c0ee8a4fe5642aa41d9956e7ed89f5cb3bc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"da41b07f92d255d3238b29ad30df8c0ee8a4fe5642aa41d9956e7ed89f5cb3bc","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:09:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9b729fee5f198546b25447d43f6aac3c5d2da0ab25e3729b865bc3257e29673a"}
{"level":"info","ts":"2026-07-09T18:09:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6ee14c9a53dc59919e28b7773ad6206643890488615762489970584fb5b8cebc"}
{"level":"debug","ts":"2026-07-09T18:09:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b9584ebcf8d46881d38f3513d0376292687cbb01a53b0f009d710eed97cd765c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:09:49Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:09:49Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:09:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b9584ebcf8d46881d38f3513d0376292687cbb01a53b0f009d710eed97cd765c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"da41b07f92d255d3238b29ad30df8c0ee8a4fe5642aa41d9956e7ed89f5cb3bc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:09:49Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:09:49Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:09:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/da41b07f92d255d3238b29ad30df8c0ee8a4fe5642aa41d9956e7ed89f5cb3bc"}
{"level":"info","ts":"2026-07-09T18:09:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"da41b07f92d255d3238b29ad30df8c0ee8a4fe5642aa41d9956e7ed89f5cb3bc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b9584ebcf8d46881d38f3513d0376292687cbb01a53b0f009d710eed97cd765c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:09:49Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:09:49Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:09:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b9584ebcf8d46881d38f3513d0376292687cbb01a53b0f009d710eed97cd765c"}
{"level":"info","ts":"2026-07-09T18:09:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b9584ebcf8d46881d38f3513d0376292687cbb01a53b0f009d710eed97cd765c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5ed5fdcf1b3e26c3aaebfe14cee42fdab3bf6f2e2886178bd1e44703efd146bf","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:09:49Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:09:49Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:09:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5ed5fdcf1b3e26c3aaebfe14cee42fdab3bf6f2e2886178bd1e44703efd146bf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"da41b07f92d255d3238b29ad30df8c0ee8a4fe5642aa41d9956e7ed89f5cb3bc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:09:49Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:09:49Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["da41b07f92d255d3238b29ad30df8c0ee8a4fe5642aa41d9956e7ed89f5cb3bc"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:09:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5ed5fdcf1b3e26c3aaebfe14cee42fdab3bf6f2e2886178bd1e44703efd146bf"}
{"level":"info","ts":"2026-07-09T18:09:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"da41b07f92d255d3238b29ad30df8c0ee8a4fe5642aa41d9956e7ed89f5cb3bc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b9584ebcf8d46881d38f3513d0376292687cbb01a53b0f009d710eed97cd765c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:09:49Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:09:49Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b9584ebcf8d46881d38f3513d0376292687cbb01a53b0f009d710eed97cd765c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:09:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/da41b07f92d255d3238b29ad30df8c0ee8a4fe5642aa41d9956e7ed89f5cb3bc"}
{"level":"info","ts":"2026-07-09T18:09:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b9584ebcf8d46881d38f3513d0376292687cbb01a53b0f009d710eed97cd765c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5ed5fdcf1b3e26c3aaebfe14cee42fdab3bf6f2e2886178bd1e44703efd146bf","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:09:49Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:09:49Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["5ed5fdcf1b3e26c3aaebfe14cee42fdab3bf6f2e2886178bd1e44703efd146bf"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:09:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b9584ebcf8d46881d38f3513d0376292687cbb01a53b0f009d710eed97cd765c"}
{"level":"info","ts":"2026-07-09T18:09:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5ed5fdcf1b3e26c3aaebfe14cee42fdab3bf6f2e2886178bd1e44703efd146bf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"da41b07f92d255d3238b29ad30df8c0ee8a4fe5642aa41d9956e7ed89f5cb3bc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b9584ebcf8d46881d38f3513d0376292687cbb01a53b0f009d710eed97cd765c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5ed5fdcf1b3e26c3aaebfe14cee42fdab3bf6f2e2886178bd1e44703efd146bf","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:09:49Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:09:49Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:09:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5ed5fdcf1b3e26c3aaebfe14cee42fdab3bf6f2e2886178bd1e44703efd146bf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"da41b07f92d255d3238b29ad30df8c0ee8a4fe5642aa41d9956e7ed89f5cb3bc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5ed5fdcf1b3e26c3aaebfe14cee42fdab3bf6f2e2886178bd1e44703efd146bf","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:09:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5ed5fdcf1b3e26c3aaebfe14cee42fdab3bf6f2e2886178bd1e44703efd146bf"}
{"level":"debug","ts":"2026-07-09T18:09:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5ed5fdcf1b3e26c3aaebfe14cee42fdab3bf6f2e2886178bd1e44703efd146bf","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:09:49Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:09:49Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["5ed5fdcf1b3e26c3aaebfe14cee42fdab3bf6f2e2886178bd1e44703efd146bf"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:09:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5ed5fdcf1b3e26c3aaebfe14cee42fdab3bf6f2e2886178bd1e44703efd146bf","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:09:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/da41b07f92d255d3238b29ad30df8c0ee8a4fe5642aa41d9956e7ed89f5cb3bc"}
{"level":"debug","ts":"2026-07-09T18:09:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5ed5fdcf1b3e26c3aaebfe14cee42fdab3bf6f2e2886178bd1e44703efd146bf","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:09:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b9584ebcf8d46881d38f3513d0376292687cbb01a53b0f009d710eed97cd765c"}
{"level":"info","ts":"2026-07-09T18:09:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5ed5fdcf1b3e26c3aaebfe14cee42fdab3bf6f2e2886178bd1e44703efd146bf"}
{"level":"debug","ts":"2026-07-09T18:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4d338df459c3bb0beb2ad827460d59a575a3f9c2ece18ad3054f2e8981e0727a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:09:57Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:09:57Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4d338df459c3bb0beb2ad827460d59a575a3f9c2ece18ad3054f2e8981e0727a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4d338df459c3bb0beb2ad827460d59a575a3f9c2ece18ad3054f2e8981e0727a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4d338df459c3bb0beb2ad827460d59a575a3f9c2ece18ad3054f2e8981e0727a"}
{"level":"debug","ts":"2026-07-09T18:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4d338df459c3bb0beb2ad827460d59a575a3f9c2ece18ad3054f2e8981e0727a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4d338df459c3bb0beb2ad827460d59a575a3f9c2ece18ad3054f2e8981e0727a"}
{"level":"debug","ts":"2026-07-09T18:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4d338df459c3bb0beb2ad827460d59a575a3f9c2ece18ad3054f2e8981e0727a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:09:57Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:09:57Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4d338df459c3bb0beb2ad827460d59a575a3f9c2ece18ad3054f2e8981e0727a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4d338df459c3bb0beb2ad827460d59a575a3f9c2ece18ad3054f2e8981e0727a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4d338df459c3bb0beb2ad827460d59a575a3f9c2ece18ad3054f2e8981e0727a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4d338df459c3bb0beb2ad827460d59a575a3f9c2ece18ad3054f2e8981e0727a"}
{"level":"debug","ts":"2026-07-09T18:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e3b57ccc8dc7d8c5f72de9565da1d1913bcc536082cc793e353e4653d416934b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:09:57Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:09:57Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e3b57ccc8dc7d8c5f72de9565da1d1913bcc536082cc793e353e4653d416934b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e3b57ccc8dc7d8c5f72de9565da1d1913bcc536082cc793e353e4653d416934b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:09:57Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:09:57Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e3b57ccc8dc7d8c5f72de9565da1d1913bcc536082cc793e353e4653d416934b"}
{"level":"info","ts":"2026-07-09T18:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e3b57ccc8dc7d8c5f72de9565da1d1913bcc536082cc793e353e4653d416934b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e3b57ccc8dc7d8c5f72de9565da1d1913bcc536082cc793e353e4653d416934b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:09:57Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:09:57Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-09T18:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"e3b57ccc8dc7d8c5f72de9565da1d1913bcc536082cc793e353e4653d416934b","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"e3b57ccc8dc7d8c5f72de9565da1d1913bcc536082cc793e353e4653d416934b\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-09T18:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e3b57ccc8dc7d8c5f72de9565da1d1913bcc536082cc793e353e4653d416934b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e3b57ccc8dc7d8c5f72de9565da1d1913bcc536082cc793e353e4653d416934b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e3b57ccc8dc7d8c5f72de9565da1d1913bcc536082cc793e353e4653d416934b"}
{"level":"info","ts":"2026-07-09T18:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e3b57ccc8dc7d8c5f72de9565da1d1913bcc536082cc793e353e4653d416934b"}
{"level":"debug","ts":"2026-07-09T18:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d8e0850808cc3464b9bc0513c8149e79e80d6d1342e3ad0fcb38a541c9d49a0d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:09:57Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:09:57Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d8e0850808cc3464b9bc0513c8149e79e80d6d1342e3ad0fcb38a541c9d49a0d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d8e0850808cc3464b9bc0513c8149e79e80d6d1342e3ad0fcb38a541c9d49a0d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d8e0850808cc3464b9bc0513c8149e79e80d6d1342e3ad0fcb38a541c9d49a0d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e3b57ccc8dc7d8c5f72de9565da1d1913bcc536082cc793e353e4653d416934b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:09:57Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:09:57Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e3b57ccc8dc7d8c5f72de9565da1d1913bcc536082cc793e353e4653d416934b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d8e0850808cc3464b9bc0513c8149e79e80d6d1342e3ad0fcb38a541c9d49a0d"}
{"level":"info","ts":"2026-07-09T18:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e3b57ccc8dc7d8c5f72de9565da1d1913bcc536082cc793e353e4653d416934b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e3b57ccc8dc7d8c5f72de9565da1d1913bcc536082cc793e353e4653d416934b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d8e0850808cc3464b9bc0513c8149e79e80d6d1342e3ad0fcb38a541c9d49a0d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d8e0850808cc3464b9bc0513c8149e79e80d6d1342e3ad0fcb38a541c9d49a0d"}
{"level":"info","ts":"2026-07-09T18:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e3b57ccc8dc7d8c5f72de9565da1d1913bcc536082cc793e353e4653d416934b"}
{"level":"debug","ts":"2026-07-09T18:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d8e0850808cc3464b9bc0513c8149e79e80d6d1342e3ad0fcb38a541c9d49a0d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:09:57Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:09:57Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d8e0850808cc3464b9bc0513c8149e79e80d6d1342e3ad0fcb38a541c9d49a0d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d8e0850808cc3464b9bc0513c8149e79e80d6d1342e3ad0fcb38a541c9d49a0d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d8e0850808cc3464b9bc0513c8149e79e80d6d1342e3ad0fcb38a541c9d49a0d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3682972e0c81bfc88ef826fc0824c34a3a6f73b8888ffa4426c86a341dd9b2cc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:09:57Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:09:57Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3682972e0c81bfc88ef826fc0824c34a3a6f73b8888ffa4426c86a341dd9b2cc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3682972e0c81bfc88ef826fc0824c34a3a6f73b8888ffa4426c86a341dd9b2cc","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d8e0850808cc3464b9bc0513c8149e79e80d6d1342e3ad0fcb38a541c9d49a0d"}
{"level":"debug","ts":"2026-07-09T18:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3682972e0c81bfc88ef826fc0824c34a3a6f73b8888ffa4426c86a341dd9b2cc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:09:57Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:09:57Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3682972e0c81bfc88ef826fc0824c34a3a6f73b8888ffa4426c86a341dd9b2cc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3682972e0c81bfc88ef826fc0824c34a3a6f73b8888ffa4426c86a341dd9b2cc","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3682972e0c81bfc88ef826fc0824c34a3a6f73b8888ffa4426c86a341dd9b2cc"}
{"level":"debug","ts":"2026-07-09T18:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3682972e0c81bfc88ef826fc0824c34a3a6f73b8888ffa4426c86a341dd9b2cc","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3682972e0c81bfc88ef826fc0824c34a3a6f73b8888ffa4426c86a341dd9b2cc"}
{"level":"debug","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3682972e0c81bfc88ef826fc0824c34a3a6f73b8888ffa4426c86a341dd9b2cc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:09:58Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:09:58Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3682972e0c81bfc88ef826fc0824c34a3a6f73b8888ffa4426c86a341dd9b2cc"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3682972e0c81bfc88ef826fc0824c34a3a6f73b8888ffa4426c86a341dd9b2cc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3682972e0c81bfc88ef826fc0824c34a3a6f73b8888ffa4426c86a341dd9b2cc","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3682972e0c81bfc88ef826fc0824c34a3a6f73b8888ffa4426c86a341dd9b2cc"}
{"level":"debug","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d3eb3208dd32fd72a7f60aeb397e8703b8c7f0789c3b78a7e00e700668a70099","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:09:58Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:09:58Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d3eb3208dd32fd72a7f60aeb397e8703b8c7f0789c3b78a7e00e700668a70099","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d3eb3208dd32fd72a7f60aeb397e8703b8c7f0789c3b78a7e00e700668a70099","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d3eb3208dd32fd72a7f60aeb397e8703b8c7f0789c3b78a7e00e700668a70099","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d3eb3208dd32fd72a7f60aeb397e8703b8c7f0789c3b78a7e00e700668a70099"}
{"level":"debug","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d3eb3208dd32fd72a7f60aeb397e8703b8c7f0789c3b78a7e00e700668a70099","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d3eb3208dd32fd72a7f60aeb397e8703b8c7f0789c3b78a7e00e700668a70099"}
{"level":"debug","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d3eb3208dd32fd72a7f60aeb397e8703b8c7f0789c3b78a7e00e700668a70099","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:09:58Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:09:58Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d3eb3208dd32fd72a7f60aeb397e8703b8c7f0789c3b78a7e00e700668a70099"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d3eb3208dd32fd72a7f60aeb397e8703b8c7f0789c3b78a7e00e700668a70099","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d3eb3208dd32fd72a7f60aeb397e8703b8c7f0789c3b78a7e00e700668a70099","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:09:58Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:09:58Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d3eb3208dd32fd72a7f60aeb397e8703b8c7f0789c3b78a7e00e700668a70099","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"483cd2803ff352da73c766eee1ac47786603a571510b9a0bbf1824e8cb842cf5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:09:58Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:09:58Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d3eb3208dd32fd72a7f60aeb397e8703b8c7f0789c3b78a7e00e700668a70099"}
{"level":"info","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"483cd2803ff352da73c766eee1ac47786603a571510b9a0bbf1824e8cb842cf5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d3eb3208dd32fd72a7f60aeb397e8703b8c7f0789c3b78a7e00e700668a70099","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:09:58Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:09:58Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d3eb3208dd32fd72a7f60aeb397e8703b8c7f0789c3b78a7e00e700668a70099"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d3eb3208dd32fd72a7f60aeb397e8703b8c7f0789c3b78a7e00e700668a70099","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3b3177991297fdbae2c007ceba4a843cc4cee6ffb746764254c1b3c63519840e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:09:58Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:09:58Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/483cd2803ff352da73c766eee1ac47786603a571510b9a0bbf1824e8cb842cf5"}
{"level":"info","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3b3177991297fdbae2c007ceba4a843cc4cee6ffb746764254c1b3c63519840e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"483cd2803ff352da73c766eee1ac47786603a571510b9a0bbf1824e8cb842cf5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:09:58Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:09:58Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["483cd2803ff352da73c766eee1ac47786603a571510b9a0bbf1824e8cb842cf5"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"483cd2803ff352da73c766eee1ac47786603a571510b9a0bbf1824e8cb842cf5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d3eb3208dd32fd72a7f60aeb397e8703b8c7f0789c3b78a7e00e700668a70099","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3b3177991297fdbae2c007ceba4a843cc4cee6ffb746764254c1b3c63519840e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:09:58Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:09:58Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3b3177991297fdbae2c007ceba4a843cc4cee6ffb746764254c1b3c63519840e"}
{"level":"info","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3b3177991297fdbae2c007ceba4a843cc4cee6ffb746764254c1b3c63519840e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"483cd2803ff352da73c766eee1ac47786603a571510b9a0bbf1824e8cb842cf5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3b3177991297fdbae2c007ceba4a843cc4cee6ffb746764254c1b3c63519840e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:09:58Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:09:58Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3b3177991297fdbae2c007ceba4a843cc4cee6ffb746764254c1b3c63519840e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3b3177991297fdbae2c007ceba4a843cc4cee6ffb746764254c1b3c63519840e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3b3177991297fdbae2c007ceba4a843cc4cee6ffb746764254c1b3c63519840e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:09:58Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:09:58Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3b3177991297fdbae2c007ceba4a843cc4cee6ffb746764254c1b3c63519840e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d3eb3208dd32fd72a7f60aeb397e8703b8c7f0789c3b78a7e00e700668a70099"}
{"level":"error","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"3b3177991297fdbae2c007ceba4a843cc4cee6ffb746764254c1b3c63519840e","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"3b3177991297fdbae2c007ceba4a843cc4cee6ffb746764254c1b3c63519840e\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3b3177991297fdbae2c007ceba4a843cc4cee6ffb746764254c1b3c63519840e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3b3177991297fdbae2c007ceba4a843cc4cee6ffb746764254c1b3c63519840e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/483cd2803ff352da73c766eee1ac47786603a571510b9a0bbf1824e8cb842cf5"}
{"level":"info","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3b3177991297fdbae2c007ceba4a843cc4cee6ffb746764254c1b3c63519840e"}
{"level":"debug","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c2b3c24af46349faee8dfda7596caa3452a8431835067697ce51441a51cf787c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:09:58Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:09:58Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c2b3c24af46349faee8dfda7596caa3452a8431835067697ce51441a51cf787c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d9bdad4f2209ade368fb8e3e9899aed674691a49f320a4c7056f5befc66c4d25","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:09:58Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:09:58Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c2b3c24af46349faee8dfda7596caa3452a8431835067697ce51441a51cf787c"}
{"level":"info","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d9bdad4f2209ade368fb8e3e9899aed674691a49f320a4c7056f5befc66c4d25","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c2b3c24af46349faee8dfda7596caa3452a8431835067697ce51441a51cf787c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:09:58Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:09:58Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c2b3c24af46349faee8dfda7596caa3452a8431835067697ce51441a51cf787c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c2b3c24af46349faee8dfda7596caa3452a8431835067697ce51441a51cf787c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d9bdad4f2209ade368fb8e3e9899aed674691a49f320a4c7056f5befc66c4d25","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:09:58Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:09:58Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d9bdad4f2209ade368fb8e3e9899aed674691a49f320a4c7056f5befc66c4d25"}
{"level":"info","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d9bdad4f2209ade368fb8e3e9899aed674691a49f320a4c7056f5befc66c4d25","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c2b3c24af46349faee8dfda7596caa3452a8431835067697ce51441a51cf787c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:09:58Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:09:58Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c2b3c24af46349faee8dfda7596caa3452a8431835067697ce51441a51cf787c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d9bdad4f2209ade368fb8e3e9899aed674691a49f320a4c7056f5befc66c4d25","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:09:58Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:09:58Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d9bdad4f2209ade368fb8e3e9899aed674691a49f320a4c7056f5befc66c4d25"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d9bdad4f2209ade368fb8e3e9899aed674691a49f320a4c7056f5befc66c4d25","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c2b3c24af46349faee8dfda7596caa3452a8431835067697ce51441a51cf787c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d9bdad4f2209ade368fb8e3e9899aed674691a49f320a4c7056f5befc66c4d25","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c2b3c24af46349faee8dfda7596caa3452a8431835067697ce51441a51cf787c"}
{"level":"debug","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c2b3c24af46349faee8dfda7596caa3452a8431835067697ce51441a51cf787c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:09:58Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:09:58Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c2b3c24af46349faee8dfda7596caa3452a8431835067697ce51441a51cf787c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c2b3c24af46349faee8dfda7596caa3452a8431835067697ce51441a51cf787c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fb0152c795ffd8628c3162459e2c109ef00aaf623b86abca8c3eb2f72b875f8f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:09:58Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:09:58Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d9bdad4f2209ade368fb8e3e9899aed674691a49f320a4c7056f5befc66c4d25"}
{"level":"info","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fb0152c795ffd8628c3162459e2c109ef00aaf623b86abca8c3eb2f72b875f8f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c2b3c24af46349faee8dfda7596caa3452a8431835067697ce51441a51cf787c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:09:58Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:09:58Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c2b3c24af46349faee8dfda7596caa3452a8431835067697ce51441a51cf787c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1daa0a86d727e4f773a91b547d6a9a668c22588b72d01b7d25de27d3225d5e12","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:09:58Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:09:58Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1daa0a86d727e4f773a91b547d6a9a668c22588b72d01b7d25de27d3225d5e12","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fb0152c795ffd8628c3162459e2c109ef00aaf623b86abca8c3eb2f72b875f8f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c2b3c24af46349faee8dfda7596caa3452a8431835067697ce51441a51cf787c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c2b3c24af46349faee8dfda7596caa3452a8431835067697ce51441a51cf787c"}
{"level":"debug","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1daa0a86d727e4f773a91b547d6a9a668c22588b72d01b7d25de27d3225d5e12","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1daa0a86d727e4f773a91b547d6a9a668c22588b72d01b7d25de27d3225d5e12","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fb0152c795ffd8628c3162459e2c109ef00aaf623b86abca8c3eb2f72b875f8f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:09:58Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:09:58Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fb0152c795ffd8628c3162459e2c109ef00aaf623b86abca8c3eb2f72b875f8f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c2b3c24af46349faee8dfda7596caa3452a8431835067697ce51441a51cf787c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:09:58Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:09:58Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c2b3c24af46349faee8dfda7596caa3452a8431835067697ce51441a51cf787c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c2b3c24af46349faee8dfda7596caa3452a8431835067697ce51441a51cf787c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"53c0dc7040347e02c00546663eb862d156bb7be3d152eaf44f70aceb54ad7191","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:09:58Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:09:58Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fb0152c795ffd8628c3162459e2c109ef00aaf623b86abca8c3eb2f72b875f8f"}
{"level":"info","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"53c0dc7040347e02c00546663eb862d156bb7be3d152eaf44f70aceb54ad7191","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fb0152c795ffd8628c3162459e2c109ef00aaf623b86abca8c3eb2f72b875f8f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:09:58Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:09:58Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["fb0152c795ffd8628c3162459e2c109ef00aaf623b86abca8c3eb2f72b875f8f"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1daa0a86d727e4f773a91b547d6a9a668c22588b72d01b7d25de27d3225d5e12"}
{"level":"info","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fb0152c795ffd8628c3162459e2c109ef00aaf623b86abca8c3eb2f72b875f8f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1daa0a86d727e4f773a91b547d6a9a668c22588b72d01b7d25de27d3225d5e12","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:09:58Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:09:58Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1daa0a86d727e4f773a91b547d6a9a668c22588b72d01b7d25de27d3225d5e12"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1daa0a86d727e4f773a91b547d6a9a668c22588b72d01b7d25de27d3225d5e12","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c2b3c24af46349faee8dfda7596caa3452a8431835067697ce51441a51cf787c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:09:58Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:09:58Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c2b3c24af46349faee8dfda7596caa3452a8431835067697ce51441a51cf787c"}
{"level":"info","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c2b3c24af46349faee8dfda7596caa3452a8431835067697ce51441a51cf787c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"53c0dc7040347e02c00546663eb862d156bb7be3d152eaf44f70aceb54ad7191","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:09:58Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:09:58Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"53c0dc7040347e02c00546663eb862d156bb7be3d152eaf44f70aceb54ad7191","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fb0152c795ffd8628c3162459e2c109ef00aaf623b86abca8c3eb2f72b875f8f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1daa0a86d727e4f773a91b547d6a9a668c22588b72d01b7d25de27d3225d5e12","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c2b3c24af46349faee8dfda7596caa3452a8431835067697ce51441a51cf787c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:09:58Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:09:58Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c2b3c24af46349faee8dfda7596caa3452a8431835067697ce51441a51cf787c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/53c0dc7040347e02c00546663eb862d156bb7be3d152eaf44f70aceb54ad7191"}
{"level":"info","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c2b3c24af46349faee8dfda7596caa3452a8431835067697ce51441a51cf787c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"53c0dc7040347e02c00546663eb862d156bb7be3d152eaf44f70aceb54ad7191","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:09:58Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:09:58Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["53c0dc7040347e02c00546663eb862d156bb7be3d152eaf44f70aceb54ad7191"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fb0152c795ffd8628c3162459e2c109ef00aaf623b86abca8c3eb2f72b875f8f"}
{"level":"info","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"53c0dc7040347e02c00546663eb862d156bb7be3d152eaf44f70aceb54ad7191","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c2b3c24af46349faee8dfda7596caa3452a8431835067697ce51441a51cf787c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"53c0dc7040347e02c00546663eb862d156bb7be3d152eaf44f70aceb54ad7191","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1daa0a86d727e4f773a91b547d6a9a668c22588b72d01b7d25de27d3225d5e12"}
{"level":"info","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c2b3c24af46349faee8dfda7596caa3452a8431835067697ce51441a51cf787c"}
{"level":"info","ts":"2026-07-09T18:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/53c0dc7040347e02c00546663eb862d156bb7be3d152eaf44f70aceb54ad7191"}
{"level":"info","ts":"2026-07-09T18:10:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"31dd3fa9-5f26-4b70-9696-ca4ab85211d2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:59862","PortSpecifier":{"PortValue":59862}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"31dd3fa9-5f26-4b70-9696-ca4ab85211d2","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-09d279.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T18:10:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"31dd3fa9-5f26-4b70-9696-ca4ab85211d2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:59862","PortSpecifier":{"PortValue":59862}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783620600,"nanos":921063450},"http":{"id":"31dd3fa9-5f26-4b70-9696-ca4ab85211d2","method":"POST","headers":{":authority":"e2e-shared-a-09d279.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:10:00Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"31dd3fa9-5f26-4b70-9696-ca4ab85211d2","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T18:10:00Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"31dd3fa9-5f26-4b70-9696-ca4ab85211d2","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"8a03aca8-c185-4c8a-b6bd-33878f9e863c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=d0cd2685-b2e1-4705-9a11-a82c8e44ad44"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab31c6ab9b00"]}}
{"level":"debug","ts":"2026-07-09T18:10:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"31dd3fa9-5f26-4b70-9696-ca4ab85211d2","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab31c6ab9b00"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=d0cd2685-b2e1-4705-9a11-a82c8e44ad44"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"8a03aca8-c185-4c8a-b6bd-33878f9e863c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"6fff71fcd45a294412257cdd7721672479b46bddf883bead293812798aca2799"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.47:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-09d279.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:10:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"31dd3fa9-5f26-4b70-9696-ca4ab85211d2","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:10:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"31dd3fa9-5f26-4b70-9696-ca4ab85211d2","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:10:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"31dd3fa9-5f26-4b70-9696-ca4ab85211d2","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-09d279/auth-test-model-09d279\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:10:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"31dd3fa9-5f26-4b70-9696-ca4ab85211d2","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T18:10:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"31dd3fa9-5f26-4b70-9696-ca4ab85211d2","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T18:10:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"31dd3fa9-5f26-4b70-9696-ca4ab85211d2","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T18:10:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"31dd3fa9-5f26-4b70-9696-ca4ab85211d2","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T18:10:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"31dd3fa9-5f26-4b70-9696-ca4ab85211d2","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T18:10:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b44c4517-bedf-4ed7-b516-672d958959d2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:33180","PortSpecifier":{"PortValue":33180}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b44c4517-bedf-4ed7-b516-672d958959d2","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-e0b9f9.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T18:10:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b44c4517-bedf-4ed7-b516-672d958959d2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:33180","PortSpecifier":{"PortValue":33180}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783620600,"nanos":979732618},"http":{"id":"b44c4517-bedf-4ed7-b516-672d958959d2","method":"POST","headers":{":authority":"e2e-shared-b-e0b9f9.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:10:00Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"b44c4517-bedf-4ed7-b516-672d958959d2","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T18:10:01Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b44c4517-bedf-4ed7-b516-672d958959d2","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"8a03aca8-c185-4c8a-b6bd-33878f9e863c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=d0cd2685-b2e1-4705-9a11-a82c8e44ad44"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab31c6ab9b00"]}}
{"level":"debug","ts":"2026-07-09T18:10:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b44c4517-bedf-4ed7-b516-672d958959d2","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab31c6ab9b00"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=d0cd2685-b2e1-4705-9a11-a82c8e44ad44"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"8a03aca8-c185-4c8a-b6bd-33878f9e863c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"3682972e0c81bfc88ef826fc0824c34a3a6f73b8888ffa4426c86a341dd9b2cc"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.48:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-e0b9f9.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:10:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b44c4517-bedf-4ed7-b516-672d958959d2","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:10:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b44c4517-bedf-4ed7-b516-672d958959d2","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:10:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b44c4517-bedf-4ed7-b516-672d958959d2","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-e0b9f9/auth-test-model-e0b9f9\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:10:01Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"b44c4517-bedf-4ed7-b516-672d958959d2","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T18:10:01Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b44c4517-bedf-4ed7-b516-672d958959d2","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T18:10:01Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b44c4517-bedf-4ed7-b516-672d958959d2","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-09T18:10:01Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b44c4517-bedf-4ed7-b516-672d958959d2","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T18:10:01Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b44c4517-bedf-4ed7-b516-672d958959d2","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T18:10:01Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"66d0e537-c645-49d2-a2a6-a7547bb5c5c6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:59874","PortSpecifier":{"PortValue":59874}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"66d0e537-c645-49d2-a2a6-a7547bb5c5c6","method":"GET","path":"/maas-api/v1/api-keys/244816e7-631e-4518-b33d-19efa6966e85","host":"e2e-shared-a-09d279.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T18:10:01Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"66d0e537-c645-49d2-a2a6-a7547bb5c5c6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:59874","PortSpecifier":{"PortValue":59874}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783620601,"nanos":75041080},"http":{"id":"66d0e537-c645-49d2-a2a6-a7547bb5c5c6","method":"GET","headers":{":authority":"e2e-shared-a-09d279.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/api-keys/244816e7-631e-4518-b33d-19efa6966e85",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:10:01Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"66d0e537-c645-49d2-a2a6-a7547bb5c5c6","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T18:10:01Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"66d0e537-c645-49d2-a2a6-a7547bb5c5c6","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"8a03aca8-c185-4c8a-b6bd-33878f9e863c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=d0cd2685-b2e1-4705-9a11-a82c8e44ad44"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab31c6ab9b00"]}}
{"level":"debug","ts":"2026-07-09T18:10:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"66d0e537-c645-49d2-a2a6-a7547bb5c5c6","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab31c6ab9b00"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=d0cd2685-b2e1-4705-9a11-a82c8e44ad44"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"8a03aca8-c185-4c8a-b6bd-33878f9e863c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"6fff71fcd45a294412257cdd7721672479b46bddf883bead293812798aca2799"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.47:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-09d279.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/api-keys/244816e7-631e-4518-b33d-19efa6966e85",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:10:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"66d0e537-c645-49d2-a2a6-a7547bb5c5c6","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:10:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"66d0e537-c645-49d2-a2a6-a7547bb5c5c6","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:10:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"66d0e537-c645-49d2-a2a6-a7547bb5c5c6","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-09d279/auth-test-model-09d279\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:10:01Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"66d0e537-c645-49d2-a2a6-a7547bb5c5c6","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T18:10:01Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"66d0e537-c645-49d2-a2a6-a7547bb5c5c6","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T18:10:01Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"66d0e537-c645-49d2-a2a6-a7547bb5c5c6","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T18:10:01Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"66d0e537-c645-49d2-a2a6-a7547bb5c5c6","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T18:10:01Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"66d0e537-c645-49d2-a2a6-a7547bb5c5c6","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T18:10:01Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9ec66c12-ac93-4235-bc89-10c950ad2922","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:33196","PortSpecifier":{"PortValue":33196}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9ec66c12-ac93-4235-bc89-10c950ad2922","method":"GET","path":"/maas-api/v1/api-keys/5ddee307-f202-4532-8c38-7f63f8c76191","host":"e2e-shared-b-e0b9f9.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T18:10:01Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9ec66c12-ac93-4235-bc89-10c950ad2922","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:33196","PortSpecifier":{"PortValue":33196}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783620601,"nanos":114135910},"http":{"id":"9ec66c12-ac93-4235-bc89-10c950ad2922","method":"GET","headers":{":authority":"e2e-shared-b-e0b9f9.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/api-keys/5ddee307-f202-4532-8c38-7f63f8c76191",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:10:01Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"9ec66c12-ac93-4235-bc89-10c950ad2922","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T18:10:01Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9ec66c12-ac93-4235-bc89-10c950ad2922","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"8a03aca8-c185-4c8a-b6bd-33878f9e863c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=d0cd2685-b2e1-4705-9a11-a82c8e44ad44"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab31c6ab9b00"]}}
{"level":"debug","ts":"2026-07-09T18:10:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9ec66c12-ac93-4235-bc89-10c950ad2922","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab31c6ab9b00"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=d0cd2685-b2e1-4705-9a11-a82c8e44ad44"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"8a03aca8-c185-4c8a-b6bd-33878f9e863c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"3682972e0c81bfc88ef826fc0824c34a3a6f73b8888ffa4426c86a341dd9b2cc"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.48:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-e0b9f9.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/api-keys/5ddee307-f202-4532-8c38-7f63f8c76191",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:10:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9ec66c12-ac93-4235-bc89-10c950ad2922","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:10:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9ec66c12-ac93-4235-bc89-10c950ad2922","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:10:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9ec66c12-ac93-4235-bc89-10c950ad2922","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-e0b9f9/auth-test-model-e0b9f9\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:10:01Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"9ec66c12-ac93-4235-bc89-10c950ad2922","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T18:10:01Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9ec66c12-ac93-4235-bc89-10c950ad2922","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T18:10:01Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9ec66c12-ac93-4235-bc89-10c950ad2922","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T18:10:01Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9ec66c12-ac93-4235-bc89-10c950ad2922","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T18:10:01Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9ec66c12-ac93-4235-bc89-10c950ad2922","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T18:10:18Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1713238a-bb8e-47b4-8064-f22fcf882010","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:52968","PortSpecifier":{"PortValue":52968}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1713238a-bb8e-47b4-8064-f22fcf882010","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-09d279.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T18:10:18Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1713238a-bb8e-47b4-8064-f22fcf882010","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:52968","PortSpecifier":{"PortValue":52968}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783620618,"nanos":327583532},"http":{"id":"1713238a-bb8e-47b4-8064-f22fcf882010","method":"POST","headers":{":authority":"e2e-shared-a-09d279.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:10:18Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"1713238a-bb8e-47b4-8064-f22fcf882010","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T18:10:18Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1713238a-bb8e-47b4-8064-f22fcf882010","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"8a03aca8-c185-4c8a-b6bd-33878f9e863c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=d0cd2685-b2e1-4705-9a11-a82c8e44ad44"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab31c6ab9b00"]}}
{"level":"debug","ts":"2026-07-09T18:10:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1713238a-bb8e-47b4-8064-f22fcf882010","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab31c6ab9b00"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=d0cd2685-b2e1-4705-9a11-a82c8e44ad44"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"8a03aca8-c185-4c8a-b6bd-33878f9e863c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"6fff71fcd45a294412257cdd7721672479b46bddf883bead293812798aca2799"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.47:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-09d279.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:10:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1713238a-bb8e-47b4-8064-f22fcf882010","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:10:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1713238a-bb8e-47b4-8064-f22fcf882010","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:10:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1713238a-bb8e-47b4-8064-f22fcf882010","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-09d279/auth-test-model-09d279\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:10:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"1713238a-bb8e-47b4-8064-f22fcf882010","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T18:10:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1713238a-bb8e-47b4-8064-f22fcf882010","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T18:10:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1713238a-bb8e-47b4-8064-f22fcf882010","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T18:10:18Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1713238a-bb8e-47b4-8064-f22fcf882010","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T18:10:18Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1713238a-bb8e-47b4-8064-f22fcf882010","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T18:10:18Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"bfca4904-6863-498d-b9e3-47a4729494ee","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:44276","PortSpecifier":{"PortValue":44276}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"bfca4904-6863-498d-b9e3-47a4729494ee","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-e0b9f9.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T18:10:18Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"bfca4904-6863-498d-b9e3-47a4729494ee","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:44276","PortSpecifier":{"PortValue":44276}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783620618,"nanos":365410842},"http":{"id":"bfca4904-6863-498d-b9e3-47a4729494ee","method":"POST","headers":{":authority":"e2e-shared-b-e0b9f9.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:10:18Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"bfca4904-6863-498d-b9e3-47a4729494ee","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T18:10:18Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"bfca4904-6863-498d-b9e3-47a4729494ee","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"8a03aca8-c185-4c8a-b6bd-33878f9e863c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=d0cd2685-b2e1-4705-9a11-a82c8e44ad44"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab31c6ab9b00"]}}
{"level":"debug","ts":"2026-07-09T18:10:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"bfca4904-6863-498d-b9e3-47a4729494ee","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab31c6ab9b00"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=d0cd2685-b2e1-4705-9a11-a82c8e44ad44"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"8a03aca8-c185-4c8a-b6bd-33878f9e863c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"3682972e0c81bfc88ef826fc0824c34a3a6f73b8888ffa4426c86a341dd9b2cc"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.48:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-e0b9f9.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:10:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bfca4904-6863-498d-b9e3-47a4729494ee","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:10:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bfca4904-6863-498d-b9e3-47a4729494ee","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:10:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bfca4904-6863-498d-b9e3-47a4729494ee","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-e0b9f9/auth-test-model-e0b9f9\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:10:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"bfca4904-6863-498d-b9e3-47a4729494ee","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T18:10:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bfca4904-6863-498d-b9e3-47a4729494ee","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T18:10:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bfca4904-6863-498d-b9e3-47a4729494ee","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-09T18:10:18Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"bfca4904-6863-498d-b9e3-47a4729494ee","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T18:10:18Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"bfca4904-6863-498d-b9e3-47a4729494ee","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T18:10:18Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"71b9e1be-cfe9-48a3-aa82-deaca0a57e11","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:52984","PortSpecifier":{"PortValue":52984}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"71b9e1be-cfe9-48a3-aa82-deaca0a57e11","method":"GET","path":"/maas-api/v1/subscriptions","host":"e2e-shared-a-09d279.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T18:10:18Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"71b9e1be-cfe9-48a3-aa82-deaca0a57e11","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:52984","PortSpecifier":{"PortValue":52984}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783620618,"nanos":400737218},"http":{"id":"71b9e1be-cfe9-48a3-aa82-deaca0a57e11","method":"GET","headers":{":authority":"e2e-shared-a-09d279.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/subscriptions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:10:18Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"71b9e1be-cfe9-48a3-aa82-deaca0a57e11","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-wK8SNCvbTTWP3HJT_mWfTzChkbWgRATOAEjmvZsYyNQFSNXWjrntF6OlaG8s"}
{"level":"debug","ts":"2026-07-09T18:10:18Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"71b9e1be-cfe9-48a3-aa82-deaca0a57e11","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-09d279.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-wK8SNCvbTTWP3HJT_mWfTzChkbWgRATOAEjmvZsYyNQFSNXWjrntF6OlaG8s\"}"}
{"level":"debug","ts":"2026-07-09T18:10:18Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"71b9e1be-cfe9-48a3-aa82-deaca0a57e11","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-09d279.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"e4a841a4-62c0-4b10-9e13-498e3e456bf8","keyName":"e2e-auth-iso-a-134f85","subscription":"e2e-auth-iso-34f169","tenant":"e2e-shared-a-09d279","userId":"e4a841a4-62c0-4b10-9e13-498e3e456bf8","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T18:10:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"71b9e1be-cfe9-48a3-aa82-deaca0a57e11","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:10:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"71b9e1be-cfe9-48a3-aa82-deaca0a57e11","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:10:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"71b9e1be-cfe9-48a3-aa82-deaca0a57e11","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:10:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"71b9e1be-cfe9-48a3-aa82-deaca0a57e11","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-09d279/auth-test-model-09d279\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:10:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"71b9e1be-cfe9-48a3-aa82-deaca0a57e11","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-09T18:10:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"71b9e1be-cfe9-48a3-aa82-deaca0a57e11","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-auth-iso-34f169"}
{"level":"debug","ts":"2026-07-09T18:10:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"71b9e1be-cfe9-48a3-aa82-deaca0a57e11","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T18:10:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"71b9e1be-cfe9-48a3-aa82-deaca0a57e11","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T18:10:18Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"71b9e1be-cfe9-48a3-aa82-deaca0a57e11","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T18:10:18Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"71b9e1be-cfe9-48a3-aa82-deaca0a57e11","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T18:10:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a76a1380-5f47-4309-979c-a43c9aef8d77","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:36218","PortSpecifier":{"PortValue":36218}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a76a1380-5f47-4309-979c-a43c9aef8d77","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-09d279.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T18:10:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a76a1380-5f47-4309-979c-a43c9aef8d77","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:36218","PortSpecifier":{"PortValue":36218}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783620635,"nanos":658059731},"http":{"id":"a76a1380-5f47-4309-979c-a43c9aef8d77","method":"POST","headers":{":authority":"e2e-shared-a-09d279.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:10:35Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"a76a1380-5f47-4309-979c-a43c9aef8d77","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T18:10:35Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a76a1380-5f47-4309-979c-a43c9aef8d77","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"8a03aca8-c185-4c8a-b6bd-33878f9e863c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=d0cd2685-b2e1-4705-9a11-a82c8e44ad44"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab31c6ab9b00"]}}
{"level":"debug","ts":"2026-07-09T18:10:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a76a1380-5f47-4309-979c-a43c9aef8d77","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab31c6ab9b00"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=d0cd2685-b2e1-4705-9a11-a82c8e44ad44"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"8a03aca8-c185-4c8a-b6bd-33878f9e863c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"6fff71fcd45a294412257cdd7721672479b46bddf883bead293812798aca2799"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.47:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-09d279.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:10:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a76a1380-5f47-4309-979c-a43c9aef8d77","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:10:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a76a1380-5f47-4309-979c-a43c9aef8d77","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:10:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a76a1380-5f47-4309-979c-a43c9aef8d77","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-09d279/auth-test-model-09d279\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:10:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"a76a1380-5f47-4309-979c-a43c9aef8d77","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T18:10:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a76a1380-5f47-4309-979c-a43c9aef8d77","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T18:10:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a76a1380-5f47-4309-979c-a43c9aef8d77","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T18:10:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a76a1380-5f47-4309-979c-a43c9aef8d77","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T18:10:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a76a1380-5f47-4309-979c-a43c9aef8d77","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T18:10:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fb1b08b3-a0de-4a43-8da4-df4eb66dea68","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:44558","PortSpecifier":{"PortValue":44558}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"fb1b08b3-a0de-4a43-8da4-df4eb66dea68","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-e0b9f9.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T18:10:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fb1b08b3-a0de-4a43-8da4-df4eb66dea68","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:44558","PortSpecifier":{"PortValue":44558}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783620635,"nanos":691426237},"http":{"id":"fb1b08b3-a0de-4a43-8da4-df4eb66dea68","method":"POST","headers":{":authority":"e2e-shared-b-e0b9f9.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:10:35Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"fb1b08b3-a0de-4a43-8da4-df4eb66dea68","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T18:10:35Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"fb1b08b3-a0de-4a43-8da4-df4eb66dea68","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"8a03aca8-c185-4c8a-b6bd-33878f9e863c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=d0cd2685-b2e1-4705-9a11-a82c8e44ad44"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab31c6ab9b00"]}}
{"level":"debug","ts":"2026-07-09T18:10:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"fb1b08b3-a0de-4a43-8da4-df4eb66dea68","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab31c6ab9b00"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=d0cd2685-b2e1-4705-9a11-a82c8e44ad44"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"8a03aca8-c185-4c8a-b6bd-33878f9e863c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"3682972e0c81bfc88ef826fc0824c34a3a6f73b8888ffa4426c86a341dd9b2cc"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.48:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-e0b9f9.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:10:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fb1b08b3-a0de-4a43-8da4-df4eb66dea68","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:10:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fb1b08b3-a0de-4a43-8da4-df4eb66dea68","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:10:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fb1b08b3-a0de-4a43-8da4-df4eb66dea68","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-e0b9f9/auth-test-model-e0b9f9\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:10:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"fb1b08b3-a0de-4a43-8da4-df4eb66dea68","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T18:10:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fb1b08b3-a0de-4a43-8da4-df4eb66dea68","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T18:10:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fb1b08b3-a0de-4a43-8da4-df4eb66dea68","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-09T18:10:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fb1b08b3-a0de-4a43-8da4-df4eb66dea68","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T18:10:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fb1b08b3-a0de-4a43-8da4-df4eb66dea68","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T18:10:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"dc698da6-d94c-4bf3-b159-cff8a31b8193","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:44574","PortSpecifier":{"PortValue":44574}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"dc698da6-d94c-4bf3-b159-cff8a31b8193","method":"GET","path":"/maas-api/v1/subscriptions","host":"e2e-shared-b-e0b9f9.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T18:10:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"dc698da6-d94c-4bf3-b159-cff8a31b8193","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:44574","PortSpecifier":{"PortValue":44574}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783620635,"nanos":736574127},"http":{"id":"dc698da6-d94c-4bf3-b159-cff8a31b8193","method":"GET","headers":{":authority":"e2e-shared-b-e0b9f9.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/subscriptions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:10:35Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"dc698da6-d94c-4bf3-b159-cff8a31b8193","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-O7EchO4awMNjWdAw_Y5TcgQ9c23veOqXpmzq6dN7aXay0El3KCUDsFTzSztI"}
{"level":"debug","ts":"2026-07-09T18:10:35Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"dc698da6-d94c-4bf3-b159-cff8a31b8193","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-e0b9f9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-O7EchO4awMNjWdAw_Y5TcgQ9c23veOqXpmzq6dN7aXay0El3KCUDsFTzSztI\"}"}
{"level":"debug","ts":"2026-07-09T18:10:35Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"dc698da6-d94c-4bf3-b159-cff8a31b8193","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-e0b9f9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"reason":"key not found","tenant":"","valid":false}}
{"level":"debug","ts":"2026-07-09T18:10:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"dc698da6-d94c-4bf3-b159-cff8a31b8193","input":{"auth":{"identity":"Bearer **** not found","tenant":"","valid":false}}},"context":{"context_extensions":{"host":"3682972e0c81bfc88ef826fc0824c34a3a6f73b8888ffa4426c86a341dd9b2cc"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.48:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-e0b9f9.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/subscriptions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:10:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dc698da6-d94c-4bf3-b159-cff8a31b8193","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:10:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access denied","request id":"dc698da6-d94c-4bf3-b159-cff8a31b8193","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"reason":"Unauthorized"}
{"level":"info","ts":"2026-07-09T18:10:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"dc698da6-d94c-4bf3-b159-cff8a31b8193","authorized":false,"response":"PERMISSION_DENIED","object":{"code":7,"status":403,"message":"Unauthorized"}}
{"level":"debug","ts":"2026-07-09T18:10:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"dc698da6-d94c-4bf3-b159-cff8a31b8193","authorized":false,"response":"PERMISSION_DENIED","object":{"code":7,"status":403,"message":"Unauthorized","headers":[{"content-type":"application/json"},{"x-ext-auth-reason":""}],"body":"{\"error\": {\"type\": \"permission_error\", \"message\": \"API key is invalid or has been revoked\"}}"}}
{"level":"info","ts":"2026-07-09T18:10:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"595d0530-fb6d-4b3e-b184-8b9982bcf1bc","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:59998","PortSpecifier":{"PortValue":59998}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"595d0530-fb6d-4b3e-b184-8b9982bcf1bc","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-09d279.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T18:10:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"595d0530-fb6d-4b3e-b184-8b9982bcf1bc","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:59998","PortSpecifier":{"PortValue":59998}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783620652,"nanos":934780935},"http":{"id":"595d0530-fb6d-4b3e-b184-8b9982bcf1bc","method":"POST","headers":{":authority":"e2e-shared-a-09d279.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:10:52Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"595d0530-fb6d-4b3e-b184-8b9982bcf1bc","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T18:10:52Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"595d0530-fb6d-4b3e-b184-8b9982bcf1bc","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"8a03aca8-c185-4c8a-b6bd-33878f9e863c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=d0cd2685-b2e1-4705-9a11-a82c8e44ad44"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab31c6ab9b00"]}}
{"level":"debug","ts":"2026-07-09T18:10:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"595d0530-fb6d-4b3e-b184-8b9982bcf1bc","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab31c6ab9b00"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=d0cd2685-b2e1-4705-9a11-a82c8e44ad44"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"8a03aca8-c185-4c8a-b6bd-33878f9e863c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"6fff71fcd45a294412257cdd7721672479b46bddf883bead293812798aca2799"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.47:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-09d279.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:10:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"595d0530-fb6d-4b3e-b184-8b9982bcf1bc","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:10:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"595d0530-fb6d-4b3e-b184-8b9982bcf1bc","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:10:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"595d0530-fb6d-4b3e-b184-8b9982bcf1bc","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-09d279/auth-test-model-09d279\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:10:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"595d0530-fb6d-4b3e-b184-8b9982bcf1bc","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T18:10:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"595d0530-fb6d-4b3e-b184-8b9982bcf1bc","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T18:10:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"595d0530-fb6d-4b3e-b184-8b9982bcf1bc","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T18:10:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"595d0530-fb6d-4b3e-b184-8b9982bcf1bc","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T18:10:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"595d0530-fb6d-4b3e-b184-8b9982bcf1bc","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T18:10:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a6317f1b-5961-445b-aa44-a7d54c280fe7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:41280","PortSpecifier":{"PortValue":41280}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a6317f1b-5961-445b-aa44-a7d54c280fe7","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-e0b9f9.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T18:10:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a6317f1b-5961-445b-aa44-a7d54c280fe7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:41280","PortSpecifier":{"PortValue":41280}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783620652,"nanos":969473330},"http":{"id":"a6317f1b-5961-445b-aa44-a7d54c280fe7","method":"POST","headers":{":authority":"e2e-shared-b-e0b9f9.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:10:52Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"a6317f1b-5961-445b-aa44-a7d54c280fe7","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T18:10:52Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a6317f1b-5961-445b-aa44-a7d54c280fe7","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"8a03aca8-c185-4c8a-b6bd-33878f9e863c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=d0cd2685-b2e1-4705-9a11-a82c8e44ad44"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab31c6ab9b00"]}}
{"level":"debug","ts":"2026-07-09T18:10:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a6317f1b-5961-445b-aa44-a7d54c280fe7","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab31c6ab9b00"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=d0cd2685-b2e1-4705-9a11-a82c8e44ad44"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"8a03aca8-c185-4c8a-b6bd-33878f9e863c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"3682972e0c81bfc88ef826fc0824c34a3a6f73b8888ffa4426c86a341dd9b2cc"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.48:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-e0b9f9.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:10:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a6317f1b-5961-445b-aa44-a7d54c280fe7","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:10:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a6317f1b-5961-445b-aa44-a7d54c280fe7","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:10:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a6317f1b-5961-445b-aa44-a7d54c280fe7","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-e0b9f9/auth-test-model-e0b9f9\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:10:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"a6317f1b-5961-445b-aa44-a7d54c280fe7","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T18:10:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a6317f1b-5961-445b-aa44-a7d54c280fe7","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T18:10:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a6317f1b-5961-445b-aa44-a7d54c280fe7","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-09T18:10:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a6317f1b-5961-445b-aa44-a7d54c280fe7","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T18:10:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a6317f1b-5961-445b-aa44-a7d54c280fe7","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T18:10:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a4f6c866-c53b-4c8c-89b9-6567f4b0795d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:60010","PortSpecifier":{"PortValue":60010}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a4f6c866-c53b-4c8c-89b9-6567f4b0795d","method":"POST","path":"/maas-api/v1/api-keys/search","host":"e2e-shared-a-09d279.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T18:10:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a4f6c866-c53b-4c8c-89b9-6567f4b0795d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:60010","PortSpecifier":{"PortValue":60010}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783620653,"nanos":4980348},"http":{"id":"a4f6c866-c53b-4c8c-89b9-6567f4b0795d","method":"POST","headers":{":authority":"e2e-shared-a-09d279.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys/search",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:10:53Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"a4f6c866-c53b-4c8c-89b9-6567f4b0795d","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T18:10:53Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a4f6c866-c53b-4c8c-89b9-6567f4b0795d","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"8a03aca8-c185-4c8a-b6bd-33878f9e863c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=d0cd2685-b2e1-4705-9a11-a82c8e44ad44"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab31c6ab9b00"]}}
{"level":"debug","ts":"2026-07-09T18:10:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a4f6c866-c53b-4c8c-89b9-6567f4b0795d","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab31c6ab9b00"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=d0cd2685-b2e1-4705-9a11-a82c8e44ad44"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"8a03aca8-c185-4c8a-b6bd-33878f9e863c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"6fff71fcd45a294412257cdd7721672479b46bddf883bead293812798aca2799"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.47:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-09d279.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys/search",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:10:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a4f6c866-c53b-4c8c-89b9-6567f4b0795d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:10:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a4f6c866-c53b-4c8c-89b9-6567f4b0795d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:10:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a4f6c866-c53b-4c8c-89b9-6567f4b0795d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-09d279/auth-test-model-09d279\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:10:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"a4f6c866-c53b-4c8c-89b9-6567f4b0795d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T18:10:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a4f6c866-c53b-4c8c-89b9-6567f4b0795d","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T18:10:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a4f6c866-c53b-4c8c-89b9-6567f4b0795d","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T18:10:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a4f6c866-c53b-4c8c-89b9-6567f4b0795d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T18:10:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a4f6c866-c53b-4c8c-89b9-6567f4b0795d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T18:10:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7471726f-a863-483f-a2e1-bd39ab3887fa","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:41290","PortSpecifier":{"PortValue":41290}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"7471726f-a863-483f-a2e1-bd39ab3887fa","method":"POST","path":"/maas-api/v1/api-keys/search","host":"e2e-shared-b-e0b9f9.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T18:10:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7471726f-a863-483f-a2e1-bd39ab3887fa","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:41290","PortSpecifier":{"PortValue":41290}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783620653,"nanos":40808882},"http":{"id":"7471726f-a863-483f-a2e1-bd39ab3887fa","method":"POST","headers":{":authority":"e2e-shared-b-e0b9f9.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys/search",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:10:53Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"7471726f-a863-483f-a2e1-bd39ab3887fa","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T18:10:53Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"7471726f-a863-483f-a2e1-bd39ab3887fa","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"8a03aca8-c185-4c8a-b6bd-33878f9e863c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=d0cd2685-b2e1-4705-9a11-a82c8e44ad44"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab31c6ab9b00"]}}
{"level":"debug","ts":"2026-07-09T18:10:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"7471726f-a863-483f-a2e1-bd39ab3887fa","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab31c6ab9b00"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=d0cd2685-b2e1-4705-9a11-a82c8e44ad44"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"8a03aca8-c185-4c8a-b6bd-33878f9e863c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"3682972e0c81bfc88ef826fc0824c34a3a6f73b8888ffa4426c86a341dd9b2cc"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.48:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-e0b9f9.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys/search",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:10:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7471726f-a863-483f-a2e1-bd39ab3887fa","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:10:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7471726f-a863-483f-a2e1-bd39ab3887fa","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:10:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7471726f-a863-483f-a2e1-bd39ab3887fa","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-e0b9f9/auth-test-model-e0b9f9\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:10:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"7471726f-a863-483f-a2e1-bd39ab3887fa","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T18:10:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7471726f-a863-483f-a2e1-bd39ab3887fa","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T18:10:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7471726f-a863-483f-a2e1-bd39ab3887fa","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-09T18:10:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7471726f-a863-483f-a2e1-bd39ab3887fa","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T18:10:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7471726f-a863-483f-a2e1-bd39ab3887fa","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T18:11:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d63751c4-7184-45e9-bdbc-df048f986e48","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:54878","PortSpecifier":{"PortValue":54878}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d63751c4-7184-45e9-bdbc-df048f986e48","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-09d279.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T18:11:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d63751c4-7184-45e9-bdbc-df048f986e48","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:54878","PortSpecifier":{"PortValue":54878}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783620670,"nanos":256433412},"http":{"id":"d63751c4-7184-45e9-bdbc-df048f986e48","method":"POST","headers":{":authority":"e2e-shared-a-09d279.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:11:10Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"d63751c4-7184-45e9-bdbc-df048f986e48","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T18:11:10Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d63751c4-7184-45e9-bdbc-df048f986e48","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"8a03aca8-c185-4c8a-b6bd-33878f9e863c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=d0cd2685-b2e1-4705-9a11-a82c8e44ad44"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab31c6ab9b00"]}}
{"level":"debug","ts":"2026-07-09T18:11:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d63751c4-7184-45e9-bdbc-df048f986e48","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab31c6ab9b00"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=d0cd2685-b2e1-4705-9a11-a82c8e44ad44"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"8a03aca8-c185-4c8a-b6bd-33878f9e863c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"6fff71fcd45a294412257cdd7721672479b46bddf883bead293812798aca2799"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.47:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-09d279.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:11:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d63751c4-7184-45e9-bdbc-df048f986e48","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:11:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d63751c4-7184-45e9-bdbc-df048f986e48","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:11:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d63751c4-7184-45e9-bdbc-df048f986e48","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-09d279/auth-test-model-09d279\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:11:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"d63751c4-7184-45e9-bdbc-df048f986e48","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T18:11:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d63751c4-7184-45e9-bdbc-df048f986e48","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T18:11:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d63751c4-7184-45e9-bdbc-df048f986e48","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T18:11:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d63751c4-7184-45e9-bdbc-df048f986e48","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T18:11:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d63751c4-7184-45e9-bdbc-df048f986e48","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T18:11:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b9432b19-4cdb-46ae-b2ff-69e60c5446e6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:41688","PortSpecifier":{"PortValue":41688}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b9432b19-4cdb-46ae-b2ff-69e60c5446e6","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-e0b9f9.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T18:11:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b9432b19-4cdb-46ae-b2ff-69e60c5446e6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:41688","PortSpecifier":{"PortValue":41688}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783620670,"nanos":290102495},"http":{"id":"b9432b19-4cdb-46ae-b2ff-69e60c5446e6","method":"POST","headers":{":authority":"e2e-shared-b-e0b9f9.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:11:10Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"b9432b19-4cdb-46ae-b2ff-69e60c5446e6","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T18:11:10Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b9432b19-4cdb-46ae-b2ff-69e60c5446e6","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"8a03aca8-c185-4c8a-b6bd-33878f9e863c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=d0cd2685-b2e1-4705-9a11-a82c8e44ad44"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab31c6ab9b00"]}}
{"level":"debug","ts":"2026-07-09T18:11:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b9432b19-4cdb-46ae-b2ff-69e60c5446e6","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab31c6ab9b00"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=d0cd2685-b2e1-4705-9a11-a82c8e44ad44"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"8a03aca8-c185-4c8a-b6bd-33878f9e863c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"3682972e0c81bfc88ef826fc0824c34a3a6f73b8888ffa4426c86a341dd9b2cc"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.48:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-e0b9f9.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:11:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b9432b19-4cdb-46ae-b2ff-69e60c5446e6","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:11:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b9432b19-4cdb-46ae-b2ff-69e60c5446e6","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:11:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b9432b19-4cdb-46ae-b2ff-69e60c5446e6","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-e0b9f9/auth-test-model-e0b9f9\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:11:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"b9432b19-4cdb-46ae-b2ff-69e60c5446e6","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T18:11:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b9432b19-4cdb-46ae-b2ff-69e60c5446e6","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T18:11:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b9432b19-4cdb-46ae-b2ff-69e60c5446e6","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T18:11:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b9432b19-4cdb-46ae-b2ff-69e60c5446e6","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T18:11:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b9432b19-4cdb-46ae-b2ff-69e60c5446e6","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T18:11:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3eeef02f-4f21-41a5-9e18-bc4f4ee32de1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:41698","PortSpecifier":{"PortValue":41698}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3eeef02f-4f21-41a5-9e18-bc4f4ee32de1","method":"GET","path":"/maas-api/v1/api-keys/ffafd87a-5048-492b-ac09-ef00a7b349ee","host":"e2e-shared-b-e0b9f9.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T18:11:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3eeef02f-4f21-41a5-9e18-bc4f4ee32de1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:41698","PortSpecifier":{"PortValue":41698}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783620670,"nanos":325748160},"http":{"id":"3eeef02f-4f21-41a5-9e18-bc4f4ee32de1","method":"GET","headers":{":authority":"e2e-shared-b-e0b9f9.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/api-keys/ffafd87a-5048-492b-ac09-ef00a7b349ee",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:11:10Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"3eeef02f-4f21-41a5-9e18-bc4f4ee32de1","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T18:11:10Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3eeef02f-4f21-41a5-9e18-bc4f4ee32de1","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"8a03aca8-c185-4c8a-b6bd-33878f9e863c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=d0cd2685-b2e1-4705-9a11-a82c8e44ad44"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab31c6ab9b00"]}}
{"level":"debug","ts":"2026-07-09T18:11:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3eeef02f-4f21-41a5-9e18-bc4f4ee32de1","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab31c6ab9b00"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=d0cd2685-b2e1-4705-9a11-a82c8e44ad44"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"8a03aca8-c185-4c8a-b6bd-33878f9e863c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"3682972e0c81bfc88ef826fc0824c34a3a6f73b8888ffa4426c86a341dd9b2cc"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.48:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-e0b9f9.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/api-keys/ffafd87a-5048-492b-ac09-ef00a7b349ee",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:11:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3eeef02f-4f21-41a5-9e18-bc4f4ee32de1","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:11:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3eeef02f-4f21-41a5-9e18-bc4f4ee32de1","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:11:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3eeef02f-4f21-41a5-9e18-bc4f4ee32de1","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-e0b9f9/auth-test-model-e0b9f9\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:11:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"3eeef02f-4f21-41a5-9e18-bc4f4ee32de1","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T18:11:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3eeef02f-4f21-41a5-9e18-bc4f4ee32de1","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T18:11:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3eeef02f-4f21-41a5-9e18-bc4f4ee32de1","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T18:11:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3eeef02f-4f21-41a5-9e18-bc4f4ee32de1","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T18:11:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3eeef02f-4f21-41a5-9e18-bc4f4ee32de1","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T18:11:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7a4063bd-139e-402d-9519-05b52e37cdee","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:54882","PortSpecifier":{"PortValue":54882}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"7a4063bd-139e-402d-9519-05b52e37cdee","method":"GET","path":"/maas-api/v1/api-keys/ffafd87a-5048-492b-ac09-ef00a7b349ee","host":"e2e-shared-a-09d279.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T18:11:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7a4063bd-139e-402d-9519-05b52e37cdee","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:54882","PortSpecifier":{"PortValue":54882}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783620670,"nanos":354969409},"http":{"id":"7a4063bd-139e-402d-9519-05b52e37cdee","method":"GET","headers":{":authority":"e2e-shared-a-09d279.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/api-keys/ffafd87a-5048-492b-ac09-ef00a7b349ee",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:11:10Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"7a4063bd-139e-402d-9519-05b52e37cdee","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T18:11:10Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"7a4063bd-139e-402d-9519-05b52e37cdee","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"8a03aca8-c185-4c8a-b6bd-33878f9e863c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=d0cd2685-b2e1-4705-9a11-a82c8e44ad44"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab31c6ab9b00"]}}
{"level":"debug","ts":"2026-07-09T18:11:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"7a4063bd-139e-402d-9519-05b52e37cdee","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab31c6ab9b00"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=d0cd2685-b2e1-4705-9a11-a82c8e44ad44"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"8a03aca8-c185-4c8a-b6bd-33878f9e863c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"6fff71fcd45a294412257cdd7721672479b46bddf883bead293812798aca2799"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.47:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-09d279.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/api-keys/ffafd87a-5048-492b-ac09-ef00a7b349ee",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:11:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7a4063bd-139e-402d-9519-05b52e37cdee","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:11:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7a4063bd-139e-402d-9519-05b52e37cdee","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:11:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7a4063bd-139e-402d-9519-05b52e37cdee","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-09d279/auth-test-model-09d279\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:11:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"7a4063bd-139e-402d-9519-05b52e37cdee","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T18:11:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7a4063bd-139e-402d-9519-05b52e37cdee","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T18:11:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7a4063bd-139e-402d-9519-05b52e37cdee","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T18:11:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7a4063bd-139e-402d-9519-05b52e37cdee","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T18:11:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7a4063bd-139e-402d-9519-05b52e37cdee","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T18:11:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"78cac645-6e71-4dc4-8f77-106afda04164","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:58106","PortSpecifier":{"PortValue":58106}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"78cac645-6e71-4dc4-8f77-106afda04164","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-09d279.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T18:11:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"78cac645-6e71-4dc4-8f77-106afda04164","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:58106","PortSpecifier":{"PortValue":58106}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783620689,"nanos":818407392},"http":{"id":"78cac645-6e71-4dc4-8f77-106afda04164","method":"POST","headers":{":authority":"e2e-shared-a-09d279.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:11:29Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"78cac645-6e71-4dc4-8f77-106afda04164","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T18:11:29Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"78cac645-6e71-4dc4-8f77-106afda04164","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"8a03aca8-c185-4c8a-b6bd-33878f9e863c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=d0cd2685-b2e1-4705-9a11-a82c8e44ad44"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab31c6ab9b00"]}}
{"level":"debug","ts":"2026-07-09T18:11:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"78cac645-6e71-4dc4-8f77-106afda04164","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab31c6ab9b00"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=d0cd2685-b2e1-4705-9a11-a82c8e44ad44"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"8a03aca8-c185-4c8a-b6bd-33878f9e863c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"6fff71fcd45a294412257cdd7721672479b46bddf883bead293812798aca2799"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.47:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-09d279.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:11:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"78cac645-6e71-4dc4-8f77-106afda04164","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:11:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"78cac645-6e71-4dc4-8f77-106afda04164","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:11:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"78cac645-6e71-4dc4-8f77-106afda04164","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-09d279/auth-test-model-09d279\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:11:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"78cac645-6e71-4dc4-8f77-106afda04164","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T18:11:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"78cac645-6e71-4dc4-8f77-106afda04164","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T18:11:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"78cac645-6e71-4dc4-8f77-106afda04164","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T18:11:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"78cac645-6e71-4dc4-8f77-106afda04164","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T18:11:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"78cac645-6e71-4dc4-8f77-106afda04164","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T18:11:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"77a707f8-f5c5-4423-95c3-3ec734926c20","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:49052","PortSpecifier":{"PortValue":49052}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"77a707f8-f5c5-4423-95c3-3ec734926c20","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-e0b9f9.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T18:11:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"77a707f8-f5c5-4423-95c3-3ec734926c20","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:49052","PortSpecifier":{"PortValue":49052}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783620689,"nanos":848485189},"http":{"id":"77a707f8-f5c5-4423-95c3-3ec734926c20","method":"POST","headers":{":authority":"e2e-shared-b-e0b9f9.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:11:29Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"77a707f8-f5c5-4423-95c3-3ec734926c20","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T18:11:29Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"77a707f8-f5c5-4423-95c3-3ec734926c20","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"8a03aca8-c185-4c8a-b6bd-33878f9e863c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=d0cd2685-b2e1-4705-9a11-a82c8e44ad44"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab31c6ab9b00"]}}
{"level":"debug","ts":"2026-07-09T18:11:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"77a707f8-f5c5-4423-95c3-3ec734926c20","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab31c6ab9b00"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=d0cd2685-b2e1-4705-9a11-a82c8e44ad44"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"8a03aca8-c185-4c8a-b6bd-33878f9e863c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"3682972e0c81bfc88ef826fc0824c34a3a6f73b8888ffa4426c86a341dd9b2cc"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.48:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-e0b9f9.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:11:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"77a707f8-f5c5-4423-95c3-3ec734926c20","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:11:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"77a707f8-f5c5-4423-95c3-3ec734926c20","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:11:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"77a707f8-f5c5-4423-95c3-3ec734926c20","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-e0b9f9/auth-test-model-e0b9f9\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:11:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"77a707f8-f5c5-4423-95c3-3ec734926c20","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T18:11:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"77a707f8-f5c5-4423-95c3-3ec734926c20","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T18:11:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"77a707f8-f5c5-4423-95c3-3ec734926c20","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T18:11:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"77a707f8-f5c5-4423-95c3-3ec734926c20","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T18:11:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"77a707f8-f5c5-4423-95c3-3ec734926c20","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T18:11:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"46dd02c6-a8df-440f-a370-e0b70b19bf9c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:58120","PortSpecifier":{"PortValue":58120}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"46dd02c6-a8df-440f-a370-e0b70b19bf9c","method":"POST","path":"/maas-api/internal/v1/subscriptions/select","host":"e2e-shared-a-09d279.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T18:11:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"46dd02c6-a8df-440f-a370-e0b70b19bf9c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:58120","PortSpecifier":{"PortValue":58120}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783620689,"nanos":883595489},"http":{"id":"46dd02c6-a8df-440f-a370-e0b70b19bf9c","method":"POST","headers":{":authority":"e2e-shared-a-09d279.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/internal/v1/subscriptions/select",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:11:29Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"46dd02c6-a8df-440f-a370-e0b70b19bf9c","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-18TgA8VMIxmehmwff_b14Q61CJ8jyIH38ahKjG00g7d6h32q0Ud4BciS3CKiG"}
{"level":"debug","ts":"2026-07-09T18:11:29Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"46dd02c6-a8df-440f-a370-e0b70b19bf9c","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-09d279.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-18TgA8VMIxmehmwff_b14Q61CJ8jyIH38ahKjG00g7d6h32q0Ud4BciS3CKiG\"}"}
{"level":"debug","ts":"2026-07-09T18:11:29Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"46dd02c6-a8df-440f-a370-e0b70b19bf9c","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-09d279.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"bf324c4c-352d-44a4-b228-ef0bb238e901","keyName":"e2e-auth-iso-a-4edc51","subscription":"e2e-auth-iso-23893c","tenant":"e2e-shared-a-09d279","userId":"bf324c4c-352d-44a4-b228-ef0bb238e901","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T18:11:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"46dd02c6-a8df-440f-a370-e0b70b19bf9c","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:11:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"46dd02c6-a8df-440f-a370-e0b70b19bf9c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:11:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"46dd02c6-a8df-440f-a370-e0b70b19bf9c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:11:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"46dd02c6-a8df-440f-a370-e0b70b19bf9c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-09d279/auth-test-model-09d279\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:11:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"46dd02c6-a8df-440f-a370-e0b70b19bf9c","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T18:11:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"46dd02c6-a8df-440f-a370-e0b70b19bf9c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-09T18:11:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"46dd02c6-a8df-440f-a370-e0b70b19bf9c","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T18:11:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"46dd02c6-a8df-440f-a370-e0b70b19bf9c","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-auth-iso-23893c"}
{"level":"info","ts":"2026-07-09T18:11:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"46dd02c6-a8df-440f-a370-e0b70b19bf9c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T18:11:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"46dd02c6-a8df-440f-a370-e0b70b19bf9c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T18:11:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/290d2fac41bd55d253002bd50796785b14eb694ce384b02faec75076893be4dd"}
{"level":"info","ts":"2026-07-09T18:11:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1075f105d49b12efae941268860f7accaefab84c9f72c3aeae11d7dd6353ed60"}
{"level":"info","ts":"2026-07-09T18:11:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/5ed5fdcf1b3e26c3aaebfe14cee42fdab3bf6f2e2886178bd1e44703efd146bf"}
{"level":"info","ts":"2026-07-09T18:11:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/16ebaa544860fe8206916bd2ea5a46ae07b07ff6683dac169c4d5816253fb033"}
{"level":"info","ts":"2026-07-09T18:11:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b17b0af69100dc17ef560fa9ec51a1844291638fd4411e5a22ffee10ad16ebae"}
{"level":"info","ts":"2026-07-09T18:11:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b9584ebcf8d46881d38f3513d0376292687cbb01a53b0f009d710eed97cd765c"}
{"level":"info","ts":"2026-07-09T18:11:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6ee14c9a53dc59919e28b7773ad6206643890488615762489970584fb5b8cebc"}
{"level":"info","ts":"2026-07-09T18:11:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/8b6b7dd0b6e1dc7029af5cf5c21e7d989fac1276a2f7348b1c87e0594006419b"}
{"level":"info","ts":"2026-07-09T18:11:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d3eb3208dd32fd72a7f60aeb397e8703b8c7f0789c3b78a7e00e700668a70099"}
{"level":"info","ts":"2026-07-09T18:11:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e3b57ccc8dc7d8c5f72de9565da1d1913bcc536082cc793e353e4653d416934b"}
{"level":"info","ts":"2026-07-09T18:11:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4d338df459c3bb0beb2ad827460d59a575a3f9c2ece18ad3054f2e8981e0727a"}
{"level":"info","ts":"2026-07-09T18:11:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c2b3c24af46349faee8dfda7596caa3452a8431835067697ce51441a51cf787c"}
{"level":"info","ts":"2026-07-09T18:11:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/483cd2803ff352da73c766eee1ac47786603a571510b9a0bbf1824e8cb842cf5"}
{"level":"info","ts":"2026-07-09T18:11:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1daa0a86d727e4f773a91b547d6a9a668c22588b72d01b7d25de27d3225d5e12"}
{"level":"info","ts":"2026-07-09T18:11:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/53c0dc7040347e02c00546663eb862d156bb7be3d152eaf44f70aceb54ad7191"}
{"level":"info","ts":"2026-07-09T18:11:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/fb0152c795ffd8628c3162459e2c109ef00aaf623b86abca8c3eb2f72b875f8f"}
{"level":"debug","ts":"2026-07-09T18:11:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"05a24a615559c5b6eef4df23ca30ca5c56c8d22d7ce704871ed3968ae23d60c9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:11:51Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:11:51Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:11:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"05a24a615559c5b6eef4df23ca30ca5c56c8d22d7ce704871ed3968ae23d60c9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:11:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"05a24a615559c5b6eef4df23ca30ca5c56c8d22d7ce704871ed3968ae23d60c9","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:11:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/05a24a615559c5b6eef4df23ca30ca5c56c8d22d7ce704871ed3968ae23d60c9"}
{"level":"debug","ts":"2026-07-09T18:11:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"05a24a615559c5b6eef4df23ca30ca5c56c8d22d7ce704871ed3968ae23d60c9","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:11:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/05a24a615559c5b6eef4df23ca30ca5c56c8d22d7ce704871ed3968ae23d60c9"}
{"level":"debug","ts":"2026-07-09T18:11:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"05a24a615559c5b6eef4df23ca30ca5c56c8d22d7ce704871ed3968ae23d60c9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:11:51Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:11:51Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["05a24a615559c5b6eef4df23ca30ca5c56c8d22d7ce704871ed3968ae23d60c9"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:11:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"05a24a615559c5b6eef4df23ca30ca5c56c8d22d7ce704871ed3968ae23d60c9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:11:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"05a24a615559c5b6eef4df23ca30ca5c56c8d22d7ce704871ed3968ae23d60c9","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:11:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/05a24a615559c5b6eef4df23ca30ca5c56c8d22d7ce704871ed3968ae23d60c9"}
{"level":"debug","ts":"2026-07-09T18:11:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"64b93b6206c99cbcd672a1a996cf76d848800c7648b57bbb11d6f2e590f078b6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:11:51Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:11:51Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:11:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/64b93b6206c99cbcd672a1a996cf76d848800c7648b57bbb11d6f2e590f078b6"}
{"level":"info","ts":"2026-07-09T18:11:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"64b93b6206c99cbcd672a1a996cf76d848800c7648b57bbb11d6f2e590f078b6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:11:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"64b93b6206c99cbcd672a1a996cf76d848800c7648b57bbb11d6f2e590f078b6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:11:51Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:11:51Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["64b93b6206c99cbcd672a1a996cf76d848800c7648b57bbb11d6f2e590f078b6"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:11:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"64b93b6206c99cbcd672a1a996cf76d848800c7648b57bbb11d6f2e590f078b6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:11:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"64b93b6206c99cbcd672a1a996cf76d848800c7648b57bbb11d6f2e590f078b6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:11:51Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:11:51Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:11:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/64b93b6206c99cbcd672a1a996cf76d848800c7648b57bbb11d6f2e590f078b6"}
{"level":"error","ts":"2026-07-09T18:11:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"64b93b6206c99cbcd672a1a996cf76d848800c7648b57bbb11d6f2e590f078b6","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"64b93b6206c99cbcd672a1a996cf76d848800c7648b57bbb11d6f2e590f078b6\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-09T18:11:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"64b93b6206c99cbcd672a1a996cf76d848800c7648b57bbb11d6f2e590f078b6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:11:51Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:11:51Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:11:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"64b93b6206c99cbcd672a1a996cf76d848800c7648b57bbb11d6f2e590f078b6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:11:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"64b93b6206c99cbcd672a1a996cf76d848800c7648b57bbb11d6f2e590f078b6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:11:51Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:11:51Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:11:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/64b93b6206c99cbcd672a1a996cf76d848800c7648b57bbb11d6f2e590f078b6"}
{"level":"error","ts":"2026-07-09T18:11:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"64b93b6206c99cbcd672a1a996cf76d848800c7648b57bbb11d6f2e590f078b6","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"64b93b6206c99cbcd672a1a996cf76d848800c7648b57bbb11d6f2e590f078b6\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-09T18:11:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"64b93b6206c99cbcd672a1a996cf76d848800c7648b57bbb11d6f2e590f078b6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:11:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"64b93b6206c99cbcd672a1a996cf76d848800c7648b57bbb11d6f2e590f078b6","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:11:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/64b93b6206c99cbcd672a1a996cf76d848800c7648b57bbb11d6f2e590f078b6"}
{"level":"debug","ts":"2026-07-09T18:11:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"64b93b6206c99cbcd672a1a996cf76d848800c7648b57bbb11d6f2e590f078b6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:11:51Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:11:51Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["64b93b6206c99cbcd672a1a996cf76d848800c7648b57bbb11d6f2e590f078b6"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:11:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"64b93b6206c99cbcd672a1a996cf76d848800c7648b57bbb11d6f2e590f078b6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:11:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"64b93b6206c99cbcd672a1a996cf76d848800c7648b57bbb11d6f2e590f078b6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:11:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"32492ba5e2ed30b35c1f4021a3bae59a250c5b47879a3c708ce6518c7d0ff6e0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:11:51Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:11:51Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:11:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/64b93b6206c99cbcd672a1a996cf76d848800c7648b57bbb11d6f2e590f078b6"}
{"level":"info","ts":"2026-07-09T18:11:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"32492ba5e2ed30b35c1f4021a3bae59a250c5b47879a3c708ce6518c7d0ff6e0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:11:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"32492ba5e2ed30b35c1f4021a3bae59a250c5b47879a3c708ce6518c7d0ff6e0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:11:51Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:11:51Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:11:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/32492ba5e2ed30b35c1f4021a3bae59a250c5b47879a3c708ce6518c7d0ff6e0"}
{"level":"info","ts":"2026-07-09T18:11:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"32492ba5e2ed30b35c1f4021a3bae59a250c5b47879a3c708ce6518c7d0ff6e0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:11:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"32492ba5e2ed30b35c1f4021a3bae59a250c5b47879a3c708ce6518c7d0ff6e0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:11:51Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:11:51Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-09T18:11:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"32492ba5e2ed30b35c1f4021a3bae59a250c5b47879a3c708ce6518c7d0ff6e0","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"32492ba5e2ed30b35c1f4021a3bae59a250c5b47879a3c708ce6518c7d0ff6e0\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-09T18:11:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"32492ba5e2ed30b35c1f4021a3bae59a250c5b47879a3c708ce6518c7d0ff6e0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:11:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"32492ba5e2ed30b35c1f4021a3bae59a250c5b47879a3c708ce6518c7d0ff6e0","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:11:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/32492ba5e2ed30b35c1f4021a3bae59a250c5b47879a3c708ce6518c7d0ff6e0"}
{"level":"info","ts":"2026-07-09T18:11:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/32492ba5e2ed30b35c1f4021a3bae59a250c5b47879a3c708ce6518c7d0ff6e0"}
{"level":"debug","ts":"2026-07-09T18:11:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"32492ba5e2ed30b35c1f4021a3bae59a250c5b47879a3c708ce6518c7d0ff6e0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:11:51Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:11:51Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["32492ba5e2ed30b35c1f4021a3bae59a250c5b47879a3c708ce6518c7d0ff6e0"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:11:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"32492ba5e2ed30b35c1f4021a3bae59a250c5b47879a3c708ce6518c7d0ff6e0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:11:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"32492ba5e2ed30b35c1f4021a3bae59a250c5b47879a3c708ce6518c7d0ff6e0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:11:51Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:11:51Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:11:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"32492ba5e2ed30b35c1f4021a3bae59a250c5b47879a3c708ce6518c7d0ff6e0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:11:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"32492ba5e2ed30b35c1f4021a3bae59a250c5b47879a3c708ce6518c7d0ff6e0","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:11:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/32492ba5e2ed30b35c1f4021a3bae59a250c5b47879a3c708ce6518c7d0ff6e0"}
{"level":"debug","ts":"2026-07-09T18:11:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"32492ba5e2ed30b35c1f4021a3bae59a250c5b47879a3c708ce6518c7d0ff6e0","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:11:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/32492ba5e2ed30b35c1f4021a3bae59a250c5b47879a3c708ce6518c7d0ff6e0"}
{"level":"debug","ts":"2026-07-09T18:11:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"32492ba5e2ed30b35c1f4021a3bae59a250c5b47879a3c708ce6518c7d0ff6e0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:11:52Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:11:52Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["32492ba5e2ed30b35c1f4021a3bae59a250c5b47879a3c708ce6518c7d0ff6e0"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:11:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"32492ba5e2ed30b35c1f4021a3bae59a250c5b47879a3c708ce6518c7d0ff6e0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:11:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"32492ba5e2ed30b35c1f4021a3bae59a250c5b47879a3c708ce6518c7d0ff6e0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:11:52Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:11:52Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:11:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"32492ba5e2ed30b35c1f4021a3bae59a250c5b47879a3c708ce6518c7d0ff6e0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:11:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"866365b517230ea961a3d6f3740db5f55c33a9de2227f68a2a72be61a0d3827a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:11:52Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:11:52Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:11:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/32492ba5e2ed30b35c1f4021a3bae59a250c5b47879a3c708ce6518c7d0ff6e0"}
{"level":"info","ts":"2026-07-09T18:11:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"866365b517230ea961a3d6f3740db5f55c33a9de2227f68a2a72be61a0d3827a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:11:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"32492ba5e2ed30b35c1f4021a3bae59a250c5b47879a3c708ce6518c7d0ff6e0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:11:52Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:11:52Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["32492ba5e2ed30b35c1f4021a3bae59a250c5b47879a3c708ce6518c7d0ff6e0"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:11:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/866365b517230ea961a3d6f3740db5f55c33a9de2227f68a2a72be61a0d3827a"}
{"level":"info","ts":"2026-07-09T18:11:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"32492ba5e2ed30b35c1f4021a3bae59a250c5b47879a3c708ce6518c7d0ff6e0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:11:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"866365b517230ea961a3d6f3740db5f55c33a9de2227f68a2a72be61a0d3827a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:11:52Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:11:52Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["866365b517230ea961a3d6f3740db5f55c33a9de2227f68a2a72be61a0d3827a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:11:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"866365b517230ea961a3d6f3740db5f55c33a9de2227f68a2a72be61a0d3827a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:11:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"32492ba5e2ed30b35c1f4021a3bae59a250c5b47879a3c708ce6518c7d0ff6e0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:11:52Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:11:52Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:11:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/32492ba5e2ed30b35c1f4021a3bae59a250c5b47879a3c708ce6518c7d0ff6e0"}
{"level":"info","ts":"2026-07-09T18:11:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"32492ba5e2ed30b35c1f4021a3bae59a250c5b47879a3c708ce6518c7d0ff6e0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:11:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"866365b517230ea961a3d6f3740db5f55c33a9de2227f68a2a72be61a0d3827a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:11:52Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:11:52Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:11:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"866365b517230ea961a3d6f3740db5f55c33a9de2227f68a2a72be61a0d3827a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:11:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"32492ba5e2ed30b35c1f4021a3bae59a250c5b47879a3c708ce6518c7d0ff6e0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:11:52Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:11:52Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["32492ba5e2ed30b35c1f4021a3bae59a250c5b47879a3c708ce6518c7d0ff6e0"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:11:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/866365b517230ea961a3d6f3740db5f55c33a9de2227f68a2a72be61a0d3827a"}
{"level":"info","ts":"2026-07-09T18:11:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"32492ba5e2ed30b35c1f4021a3bae59a250c5b47879a3c708ce6518c7d0ff6e0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:11:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"866365b517230ea961a3d6f3740db5f55c33a9de2227f68a2a72be61a0d3827a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:11:52Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:11:52Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["866365b517230ea961a3d6f3740db5f55c33a9de2227f68a2a72be61a0d3827a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:11:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"866365b517230ea961a3d6f3740db5f55c33a9de2227f68a2a72be61a0d3827a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:11:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"32492ba5e2ed30b35c1f4021a3bae59a250c5b47879a3c708ce6518c7d0ff6e0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:11:52Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:11:52Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:11:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/32492ba5e2ed30b35c1f4021a3bae59a250c5b47879a3c708ce6518c7d0ff6e0"}
{"level":"info","ts":"2026-07-09T18:11:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"32492ba5e2ed30b35c1f4021a3bae59a250c5b47879a3c708ce6518c7d0ff6e0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:11:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"866365b517230ea961a3d6f3740db5f55c33a9de2227f68a2a72be61a0d3827a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:11:52Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:11:52Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:11:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"866365b517230ea961a3d6f3740db5f55c33a9de2227f68a2a72be61a0d3827a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:11:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"32492ba5e2ed30b35c1f4021a3bae59a250c5b47879a3c708ce6518c7d0ff6e0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:11:52Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:11:52Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["32492ba5e2ed30b35c1f4021a3bae59a250c5b47879a3c708ce6518c7d0ff6e0"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:11:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/866365b517230ea961a3d6f3740db5f55c33a9de2227f68a2a72be61a0d3827a"}
{"level":"info","ts":"2026-07-09T18:11:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"32492ba5e2ed30b35c1f4021a3bae59a250c5b47879a3c708ce6518c7d0ff6e0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:11:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"866365b517230ea961a3d6f3740db5f55c33a9de2227f68a2a72be61a0d3827a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:11:52Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:11:52Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["866365b517230ea961a3d6f3740db5f55c33a9de2227f68a2a72be61a0d3827a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:11:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"866365b517230ea961a3d6f3740db5f55c33a9de2227f68a2a72be61a0d3827a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:11:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"32492ba5e2ed30b35c1f4021a3bae59a250c5b47879a3c708ce6518c7d0ff6e0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:11:52Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:11:52Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:11:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/32492ba5e2ed30b35c1f4021a3bae59a250c5b47879a3c708ce6518c7d0ff6e0"}
{"level":"info","ts":"2026-07-09T18:11:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"32492ba5e2ed30b35c1f4021a3bae59a250c5b47879a3c708ce6518c7d0ff6e0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:11:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"866365b517230ea961a3d6f3740db5f55c33a9de2227f68a2a72be61a0d3827a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:11:52Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:11:52Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:11:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"866365b517230ea961a3d6f3740db5f55c33a9de2227f68a2a72be61a0d3827a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:11:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1c22386d7a88996965a2fe2a3b6c21237f9567e5526396d024ba3786aafe6b9f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:11:52Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:11:52Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:11:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/866365b517230ea961a3d6f3740db5f55c33a9de2227f68a2a72be61a0d3827a"}
{"level":"info","ts":"2026-07-09T18:11:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1c22386d7a88996965a2fe2a3b6c21237f9567e5526396d024ba3786aafe6b9f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:11:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"32492ba5e2ed30b35c1f4021a3bae59a250c5b47879a3c708ce6518c7d0ff6e0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:11:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"866365b517230ea961a3d6f3740db5f55c33a9de2227f68a2a72be61a0d3827a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:11:52Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:11:52Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["866365b517230ea961a3d6f3740db5f55c33a9de2227f68a2a72be61a0d3827a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:11:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/32492ba5e2ed30b35c1f4021a3bae59a250c5b47879a3c708ce6518c7d0ff6e0"}
{"level":"info","ts":"2026-07-09T18:11:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"866365b517230ea961a3d6f3740db5f55c33a9de2227f68a2a72be61a0d3827a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:11:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1c22386d7a88996965a2fe2a3b6c21237f9567e5526396d024ba3786aafe6b9f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:11:52Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:11:52Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:11:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1c22386d7a88996965a2fe2a3b6c21237f9567e5526396d024ba3786aafe6b9f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:11:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"32492ba5e2ed30b35c1f4021a3bae59a250c5b47879a3c708ce6518c7d0ff6e0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:11:52Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:11:52Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["32492ba5e2ed30b35c1f4021a3bae59a250c5b47879a3c708ce6518c7d0ff6e0"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:11:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1c22386d7a88996965a2fe2a3b6c21237f9567e5526396d024ba3786aafe6b9f"}
{"level":"info","ts":"2026-07-09T18:11:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"32492ba5e2ed30b35c1f4021a3bae59a250c5b47879a3c708ce6518c7d0ff6e0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:11:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"866365b517230ea961a3d6f3740db5f55c33a9de2227f68a2a72be61a0d3827a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:11:52Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:11:52Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:11:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"866365b517230ea961a3d6f3740db5f55c33a9de2227f68a2a72be61a0d3827a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:11:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1c22386d7a88996965a2fe2a3b6c21237f9567e5526396d024ba3786aafe6b9f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:11:52Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:11:52Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1c22386d7a88996965a2fe2a3b6c21237f9567e5526396d024ba3786aafe6b9f"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:11:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/866365b517230ea961a3d6f3740db5f55c33a9de2227f68a2a72be61a0d3827a"}
{"level":"info","ts":"2026-07-09T18:11:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1c22386d7a88996965a2fe2a3b6c21237f9567e5526396d024ba3786aafe6b9f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:11:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"32492ba5e2ed30b35c1f4021a3bae59a250c5b47879a3c708ce6518c7d0ff6e0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:11:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"866365b517230ea961a3d6f3740db5f55c33a9de2227f68a2a72be61a0d3827a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:11:52Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:11:52Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["866365b517230ea961a3d6f3740db5f55c33a9de2227f68a2a72be61a0d3827a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:11:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1c22386d7a88996965a2fe2a3b6c21237f9567e5526396d024ba3786aafe6b9f"}
{"level":"info","ts":"2026-07-09T18:11:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"866365b517230ea961a3d6f3740db5f55c33a9de2227f68a2a72be61a0d3827a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:11:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3d3fdd54ab27fbb20386fddf8f228d46ff28bc28ce5b3e174227e7c701839bff","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:11:52Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:11:52Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:11:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3d3fdd54ab27fbb20386fddf8f228d46ff28bc28ce5b3e174227e7c701839bff","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:11:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1c22386d7a88996965a2fe2a3b6c21237f9567e5526396d024ba3786aafe6b9f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:11:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"866365b517230ea961a3d6f3740db5f55c33a9de2227f68a2a72be61a0d3827a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:11:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3d3fdd54ab27fbb20386fddf8f228d46ff28bc28ce5b3e174227e7c701839bff","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:11:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3d3fdd54ab27fbb20386fddf8f228d46ff28bc28ce5b3e174227e7c701839bff","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:11:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/32492ba5e2ed30b35c1f4021a3bae59a250c5b47879a3c708ce6518c7d0ff6e0"}
{"level":"debug","ts":"2026-07-09T18:11:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3d3fdd54ab27fbb20386fddf8f228d46ff28bc28ce5b3e174227e7c701839bff","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:11:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/866365b517230ea961a3d6f3740db5f55c33a9de2227f68a2a72be61a0d3827a"}
{"level":"debug","ts":"2026-07-09T18:11:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"553875db3815210b31a2b9cbd05f78726f1df4c7e67b92603ab0923dbceaa720","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:11:52Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:11:52Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:11:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3d3fdd54ab27fbb20386fddf8f228d46ff28bc28ce5b3e174227e7c701839bff"}
{"level":"info","ts":"2026-07-09T18:11:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"553875db3815210b31a2b9cbd05f78726f1df4c7e67b92603ab0923dbceaa720","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:11:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3d3fdd54ab27fbb20386fddf8f228d46ff28bc28ce5b3e174227e7c701839bff","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:11:52Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:11:52Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3d3fdd54ab27fbb20386fddf8f228d46ff28bc28ce5b3e174227e7c701839bff"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:11:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1c22386d7a88996965a2fe2a3b6c21237f9567e5526396d024ba3786aafe6b9f"}
{"level":"info","ts":"2026-07-09T18:11:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3d3fdd54ab27fbb20386fddf8f228d46ff28bc28ce5b3e174227e7c701839bff","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:11:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"350f30307fa8a522d626be3aadaa02be810be0a3d2401c3ac213850d0e198baf","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:11:52Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:11:52Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:11:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"350f30307fa8a522d626be3aadaa02be810be0a3d2401c3ac213850d0e198baf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:11:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"553875db3815210b31a2b9cbd05f78726f1df4c7e67b92603ab0923dbceaa720","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:11:52Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:11:52Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:11:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/553875db3815210b31a2b9cbd05f78726f1df4c7e67b92603ab0923dbceaa720"}
{"level":"info","ts":"2026-07-09T18:11:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"553875db3815210b31a2b9cbd05f78726f1df4c7e67b92603ab0923dbceaa720","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:11:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3d3fdd54ab27fbb20386fddf8f228d46ff28bc28ce5b3e174227e7c701839bff","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:11:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"350f30307fa8a522d626be3aadaa02be810be0a3d2401c3ac213850d0e198baf","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:11:52Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:11:52Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:11:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"350f30307fa8a522d626be3aadaa02be810be0a3d2401c3ac213850d0e198baf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:11:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"553875db3815210b31a2b9cbd05f78726f1df4c7e67b92603ab0923dbceaa720","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:11:52Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:11:52Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["553875db3815210b31a2b9cbd05f78726f1df4c7e67b92603ab0923dbceaa720"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:11:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"553875db3815210b31a2b9cbd05f78726f1df4c7e67b92603ab0923dbceaa720","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:11:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"350f30307fa8a522d626be3aadaa02be810be0a3d2401c3ac213850d0e198baf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:11:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"553875db3815210b31a2b9cbd05f78726f1df4c7e67b92603ab0923dbceaa720","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:11:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"350f30307fa8a522d626be3aadaa02be810be0a3d2401c3ac213850d0e198baf","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:11:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/350f30307fa8a522d626be3aadaa02be810be0a3d2401c3ac213850d0e198baf"}
{"level":"info","ts":"2026-07-09T18:11:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3d3fdd54ab27fbb20386fddf8f228d46ff28bc28ce5b3e174227e7c701839bff"}
{"level":"debug","ts":"2026-07-09T18:11:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"350f30307fa8a522d626be3aadaa02be810be0a3d2401c3ac213850d0e198baf","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:11:52Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:11:52Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["350f30307fa8a522d626be3aadaa02be810be0a3d2401c3ac213850d0e198baf"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:11:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"350f30307fa8a522d626be3aadaa02be810be0a3d2401c3ac213850d0e198baf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:11:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"350f30307fa8a522d626be3aadaa02be810be0a3d2401c3ac213850d0e198baf","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:11:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/553875db3815210b31a2b9cbd05f78726f1df4c7e67b92603ab0923dbceaa720"}
{"level":"info","ts":"2026-07-09T18:11:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/350f30307fa8a522d626be3aadaa02be810be0a3d2401c3ac213850d0e198baf"}
{"level":"debug","ts":"2026-07-09T18:12:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fb4e550f37dba2ea991739d1c620608c004f67ff25fd7c1b3579ae7b8447f4b6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:12:15Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:12:15Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:12:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fb4e550f37dba2ea991739d1c620608c004f67ff25fd7c1b3579ae7b8447f4b6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fb4e550f37dba2ea991739d1c620608c004f67ff25fd7c1b3579ae7b8447f4b6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fb4e550f37dba2ea991739d1c620608c004f67ff25fd7c1b3579ae7b8447f4b6","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:12:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fb4e550f37dba2ea991739d1c620608c004f67ff25fd7c1b3579ae7b8447f4b6"}
{"level":"debug","ts":"2026-07-09T18:12:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fb4e550f37dba2ea991739d1c620608c004f67ff25fd7c1b3579ae7b8447f4b6","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:12:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fb4e550f37dba2ea991739d1c620608c004f67ff25fd7c1b3579ae7b8447f4b6"}
{"level":"debug","ts":"2026-07-09T18:12:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fb4e550f37dba2ea991739d1c620608c004f67ff25fd7c1b3579ae7b8447f4b6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:12:15Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:12:15Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["fb4e550f37dba2ea991739d1c620608c004f67ff25fd7c1b3579ae7b8447f4b6"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:12:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fb4e550f37dba2ea991739d1c620608c004f67ff25fd7c1b3579ae7b8447f4b6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fb4e550f37dba2ea991739d1c620608c004f67ff25fd7c1b3579ae7b8447f4b6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:12:15Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:12:15Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:12:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fb4e550f37dba2ea991739d1c620608c004f67ff25fd7c1b3579ae7b8447f4b6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fb4e550f37dba2ea991739d1c620608c004f67ff25fd7c1b3579ae7b8447f4b6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fb4e550f37dba2ea991739d1c620608c004f67ff25fd7c1b3579ae7b8447f4b6","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:12:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fb4e550f37dba2ea991739d1c620608c004f67ff25fd7c1b3579ae7b8447f4b6"}
{"level":"debug","ts":"2026-07-09T18:12:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fb4e550f37dba2ea991739d1c620608c004f67ff25fd7c1b3579ae7b8447f4b6","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:12:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fb4e550f37dba2ea991739d1c620608c004f67ff25fd7c1b3579ae7b8447f4b6"}
{"level":"debug","ts":"2026-07-09T18:12:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fb4e550f37dba2ea991739d1c620608c004f67ff25fd7c1b3579ae7b8447f4b6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:12:15Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:12:15Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["fb4e550f37dba2ea991739d1c620608c004f67ff25fd7c1b3579ae7b8447f4b6"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:12:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fb4e550f37dba2ea991739d1c620608c004f67ff25fd7c1b3579ae7b8447f4b6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fb4e550f37dba2ea991739d1c620608c004f67ff25fd7c1b3579ae7b8447f4b6","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:12:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fb4e550f37dba2ea991739d1c620608c004f67ff25fd7c1b3579ae7b8447f4b6"}
{"level":"debug","ts":"2026-07-09T18:12:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a9654cb6027e4278b1c6f8ee10580366de223cb20b25d8844184d6989a75fc81","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:12:15Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:12:15Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:12:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a9654cb6027e4278b1c6f8ee10580366de223cb20b25d8844184d6989a75fc81","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a9654cb6027e4278b1c6f8ee10580366de223cb20b25d8844184d6989a75fc81","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:12:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a9654cb6027e4278b1c6f8ee10580366de223cb20b25d8844184d6989a75fc81"}
{"level":"debug","ts":"2026-07-09T18:12:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a9654cb6027e4278b1c6f8ee10580366de223cb20b25d8844184d6989a75fc81","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a9654cb6027e4278b1c6f8ee10580366de223cb20b25d8844184d6989a75fc81","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:12:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a9654cb6027e4278b1c6f8ee10580366de223cb20b25d8844184d6989a75fc81"}
{"level":"debug","ts":"2026-07-09T18:12:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a9654cb6027e4278b1c6f8ee10580366de223cb20b25d8844184d6989a75fc81","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:12:15Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:12:15Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a9654cb6027e4278b1c6f8ee10580366de223cb20b25d8844184d6989a75fc81"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:12:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a9654cb6027e4278b1c6f8ee10580366de223cb20b25d8844184d6989a75fc81","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a9654cb6027e4278b1c6f8ee10580366de223cb20b25d8844184d6989a75fc81","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:12:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a9654cb6027e4278b1c6f8ee10580366de223cb20b25d8844184d6989a75fc81"}
{"level":"debug","ts":"2026-07-09T18:12:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"630443086a8fe9129fe13572df10ed4db5acb8b00e255b5e462267f7d8133de8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:12:15Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:12:15Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:12:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"630443086a8fe9129fe13572df10ed4db5acb8b00e255b5e462267f7d8133de8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"630443086a8fe9129fe13572df10ed4db5acb8b00e255b5e462267f7d8133de8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:12:15Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:12:15Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:12:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/630443086a8fe9129fe13572df10ed4db5acb8b00e255b5e462267f7d8133de8"}
{"level":"info","ts":"2026-07-09T18:12:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"630443086a8fe9129fe13572df10ed4db5acb8b00e255b5e462267f7d8133de8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"630443086a8fe9129fe13572df10ed4db5acb8b00e255b5e462267f7d8133de8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:12:15Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:12:15Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-09T18:12:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"630443086a8fe9129fe13572df10ed4db5acb8b00e255b5e462267f7d8133de8","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"630443086a8fe9129fe13572df10ed4db5acb8b00e255b5e462267f7d8133de8\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-09T18:12:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"630443086a8fe9129fe13572df10ed4db5acb8b00e255b5e462267f7d8133de8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"630443086a8fe9129fe13572df10ed4db5acb8b00e255b5e462267f7d8133de8","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:12:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/630443086a8fe9129fe13572df10ed4db5acb8b00e255b5e462267f7d8133de8"}
{"level":"info","ts":"2026-07-09T18:12:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/630443086a8fe9129fe13572df10ed4db5acb8b00e255b5e462267f7d8133de8"}
{"level":"debug","ts":"2026-07-09T18:12:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f64647ce051a7330f99fefec1c3f76a918776ea681a2aea475dbf953ef700840","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:12:15Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:12:15Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:12:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f64647ce051a7330f99fefec1c3f76a918776ea681a2aea475dbf953ef700840","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"630443086a8fe9129fe13572df10ed4db5acb8b00e255b5e462267f7d8133de8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:12:15Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:12:15Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["630443086a8fe9129fe13572df10ed4db5acb8b00e255b5e462267f7d8133de8"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:12:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f64647ce051a7330f99fefec1c3f76a918776ea681a2aea475dbf953ef700840"}
{"level":"info","ts":"2026-07-09T18:12:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"630443086a8fe9129fe13572df10ed4db5acb8b00e255b5e462267f7d8133de8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f64647ce051a7330f99fefec1c3f76a918776ea681a2aea475dbf953ef700840","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:12:15Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:12:15Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:12:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f64647ce051a7330f99fefec1c3f76a918776ea681a2aea475dbf953ef700840"}
{"level":"info","ts":"2026-07-09T18:12:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f64647ce051a7330f99fefec1c3f76a918776ea681a2aea475dbf953ef700840","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"630443086a8fe9129fe13572df10ed4db5acb8b00e255b5e462267f7d8133de8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:12:15Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:12:15Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:12:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"630443086a8fe9129fe13572df10ed4db5acb8b00e255b5e462267f7d8133de8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f64647ce051a7330f99fefec1c3f76a918776ea681a2aea475dbf953ef700840","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:12:15Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:12:15Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["f64647ce051a7330f99fefec1c3f76a918776ea681a2aea475dbf953ef700840"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:12:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/630443086a8fe9129fe13572df10ed4db5acb8b00e255b5e462267f7d8133de8"}
{"level":"info","ts":"2026-07-09T18:12:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f64647ce051a7330f99fefec1c3f76a918776ea681a2aea475dbf953ef700840","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"630443086a8fe9129fe13572df10ed4db5acb8b00e255b5e462267f7d8133de8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:12:15Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:12:15Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["630443086a8fe9129fe13572df10ed4db5acb8b00e255b5e462267f7d8133de8"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:12:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f64647ce051a7330f99fefec1c3f76a918776ea681a2aea475dbf953ef700840"}
{"level":"info","ts":"2026-07-09T18:12:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"630443086a8fe9129fe13572df10ed4db5acb8b00e255b5e462267f7d8133de8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f64647ce051a7330f99fefec1c3f76a918776ea681a2aea475dbf953ef700840","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"02eaa43f5a2e2680e3123f4f54d112cacb1c868e28aedc7217e87d2b21a5701f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:12:15Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:12:15Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:12:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"02eaa43f5a2e2680e3123f4f54d112cacb1c868e28aedc7217e87d2b21a5701f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"630443086a8fe9129fe13572df10ed4db5acb8b00e255b5e462267f7d8133de8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:12:15Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:12:15Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:12:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/630443086a8fe9129fe13572df10ed4db5acb8b00e255b5e462267f7d8133de8"}
{"level":"info","ts":"2026-07-09T18:12:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"630443086a8fe9129fe13572df10ed4db5acb8b00e255b5e462267f7d8133de8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"02eaa43f5a2e2680e3123f4f54d112cacb1c868e28aedc7217e87d2b21a5701f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"630443086a8fe9129fe13572df10ed4db5acb8b00e255b5e462267f7d8133de8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:12:15Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:12:15Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["630443086a8fe9129fe13572df10ed4db5acb8b00e255b5e462267f7d8133de8"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:12:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f64647ce051a7330f99fefec1c3f76a918776ea681a2aea475dbf953ef700840"}
{"level":"info","ts":"2026-07-09T18:12:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"630443086a8fe9129fe13572df10ed4db5acb8b00e255b5e462267f7d8133de8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"02eaa43f5a2e2680e3123f4f54d112cacb1c868e28aedc7217e87d2b21a5701f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:12:15Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:12:15Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:12:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/02eaa43f5a2e2680e3123f4f54d112cacb1c868e28aedc7217e87d2b21a5701f"}
{"level":"info","ts":"2026-07-09T18:12:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"02eaa43f5a2e2680e3123f4f54d112cacb1c868e28aedc7217e87d2b21a5701f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"630443086a8fe9129fe13572df10ed4db5acb8b00e255b5e462267f7d8133de8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:12:15Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:12:15Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"630443086a8fe9129fe13572df10ed4db5acb8b00e255b5e462267f7d8133de8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"02eaa43f5a2e2680e3123f4f54d112cacb1c868e28aedc7217e87d2b21a5701f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:12:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:12:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["02eaa43f5a2e2680e3123f4f54d112cacb1c868e28aedc7217e87d2b21a5701f"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/630443086a8fe9129fe13572df10ed4db5acb8b00e255b5e462267f7d8133de8"}
{"level":"info","ts":"2026-07-09T18:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"02eaa43f5a2e2680e3123f4f54d112cacb1c868e28aedc7217e87d2b21a5701f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"630443086a8fe9129fe13572df10ed4db5acb8b00e255b5e462267f7d8133de8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:12:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:12:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["630443086a8fe9129fe13572df10ed4db5acb8b00e255b5e462267f7d8133de8"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/02eaa43f5a2e2680e3123f4f54d112cacb1c868e28aedc7217e87d2b21a5701f"}
{"level":"info","ts":"2026-07-09T18:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"630443086a8fe9129fe13572df10ed4db5acb8b00e255b5e462267f7d8133de8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"02eaa43f5a2e2680e3123f4f54d112cacb1c868e28aedc7217e87d2b21a5701f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8769041950444089e8e236502ddb0dc67357a96fee3199cfc9770eb49cdf8d8a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:12:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:12:16Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8769041950444089e8e236502ddb0dc67357a96fee3199cfc9770eb49cdf8d8a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"630443086a8fe9129fe13572df10ed4db5acb8b00e255b5e462267f7d8133de8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:12:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:12:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/630443086a8fe9129fe13572df10ed4db5acb8b00e255b5e462267f7d8133de8"}
{"level":"info","ts":"2026-07-09T18:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"630443086a8fe9129fe13572df10ed4db5acb8b00e255b5e462267f7d8133de8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8769041950444089e8e236502ddb0dc67357a96fee3199cfc9770eb49cdf8d8a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:12:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:12:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8769041950444089e8e236502ddb0dc67357a96fee3199cfc9770eb49cdf8d8a"}
{"level":"info","ts":"2026-07-09T18:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8769041950444089e8e236502ddb0dc67357a96fee3199cfc9770eb49cdf8d8a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"630443086a8fe9129fe13572df10ed4db5acb8b00e255b5e462267f7d8133de8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:12:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:12:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["630443086a8fe9129fe13572df10ed4db5acb8b00e255b5e462267f7d8133de8"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"630443086a8fe9129fe13572df10ed4db5acb8b00e255b5e462267f7d8133de8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8769041950444089e8e236502ddb0dc67357a96fee3199cfc9770eb49cdf8d8a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:12:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:12:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8769041950444089e8e236502ddb0dc67357a96fee3199cfc9770eb49cdf8d8a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/02eaa43f5a2e2680e3123f4f54d112cacb1c868e28aedc7217e87d2b21a5701f"}
{"level":"info","ts":"2026-07-09T18:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8769041950444089e8e236502ddb0dc67357a96fee3199cfc9770eb49cdf8d8a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"630443086a8fe9129fe13572df10ed4db5acb8b00e255b5e462267f7d8133de8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:12:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:12:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"630443086a8fe9129fe13572df10ed4db5acb8b00e255b5e462267f7d8133de8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8769041950444089e8e236502ddb0dc67357a96fee3199cfc9770eb49cdf8d8a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"630443086a8fe9129fe13572df10ed4db5acb8b00e255b5e462267f7d8133de8","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/630443086a8fe9129fe13572df10ed4db5acb8b00e255b5e462267f7d8133de8"}
{"level":"debug","ts":"2026-07-09T18:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"630443086a8fe9129fe13572df10ed4db5acb8b00e255b5e462267f7d8133de8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:12:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:12:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["630443086a8fe9129fe13572df10ed4db5acb8b00e255b5e462267f7d8133de8"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"630443086a8fe9129fe13572df10ed4db5acb8b00e255b5e462267f7d8133de8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ad720c037b2c267a80e7d606d4a15e99b511408406fad284e586d10c8d04afbb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:12:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:12:16Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8769041950444089e8e236502ddb0dc67357a96fee3199cfc9770eb49cdf8d8a"}
{"level":"info","ts":"2026-07-09T18:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ad720c037b2c267a80e7d606d4a15e99b511408406fad284e586d10c8d04afbb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"630443086a8fe9129fe13572df10ed4db5acb8b00e255b5e462267f7d8133de8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:12:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:12:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"630443086a8fe9129fe13572df10ed4db5acb8b00e255b5e462267f7d8133de8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ad720c037b2c267a80e7d606d4a15e99b511408406fad284e586d10c8d04afbb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"630443086a8fe9129fe13572df10ed4db5acb8b00e255b5e462267f7d8133de8","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/630443086a8fe9129fe13572df10ed4db5acb8b00e255b5e462267f7d8133de8"}
{"level":"debug","ts":"2026-07-09T18:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"630443086a8fe9129fe13572df10ed4db5acb8b00e255b5e462267f7d8133de8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:12:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:12:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["630443086a8fe9129fe13572df10ed4db5acb8b00e255b5e462267f7d8133de8"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"630443086a8fe9129fe13572df10ed4db5acb8b00e255b5e462267f7d8133de8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ad720c037b2c267a80e7d606d4a15e99b511408406fad284e586d10c8d04afbb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:12:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:12:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ad720c037b2c267a80e7d606d4a15e99b511408406fad284e586d10c8d04afbb"}
{"level":"info","ts":"2026-07-09T18:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ad720c037b2c267a80e7d606d4a15e99b511408406fad284e586d10c8d04afbb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"630443086a8fe9129fe13572df10ed4db5acb8b00e255b5e462267f7d8133de8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:12:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:12:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/630443086a8fe9129fe13572df10ed4db5acb8b00e255b5e462267f7d8133de8"}
{"level":"info","ts":"2026-07-09T18:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"630443086a8fe9129fe13572df10ed4db5acb8b00e255b5e462267f7d8133de8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ad720c037b2c267a80e7d606d4a15e99b511408406fad284e586d10c8d04afbb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"630443086a8fe9129fe13572df10ed4db5acb8b00e255b5e462267f7d8133de8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:12:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:12:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["630443086a8fe9129fe13572df10ed4db5acb8b00e255b5e462267f7d8133de8"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"630443086a8fe9129fe13572df10ed4db5acb8b00e255b5e462267f7d8133de8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ad720c037b2c267a80e7d606d4a15e99b511408406fad284e586d10c8d04afbb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0e71da54a3522462a23874baccf5bdded27cc985fcd114869a8a943890f84b6a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:12:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:12:16Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ad720c037b2c267a80e7d606d4a15e99b511408406fad284e586d10c8d04afbb"}
{"level":"info","ts":"2026-07-09T18:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0e71da54a3522462a23874baccf5bdded27cc985fcd114869a8a943890f84b6a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"630443086a8fe9129fe13572df10ed4db5acb8b00e255b5e462267f7d8133de8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:12:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:12:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"630443086a8fe9129fe13572df10ed4db5acb8b00e255b5e462267f7d8133de8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0e71da54a3522462a23874baccf5bdded27cc985fcd114869a8a943890f84b6a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"630443086a8fe9129fe13572df10ed4db5acb8b00e255b5e462267f7d8133de8","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/630443086a8fe9129fe13572df10ed4db5acb8b00e255b5e462267f7d8133de8"}
{"level":"debug","ts":"2026-07-09T18:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"630443086a8fe9129fe13572df10ed4db5acb8b00e255b5e462267f7d8133de8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:12:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:12:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["630443086a8fe9129fe13572df10ed4db5acb8b00e255b5e462267f7d8133de8"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"630443086a8fe9129fe13572df10ed4db5acb8b00e255b5e462267f7d8133de8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0e71da54a3522462a23874baccf5bdded27cc985fcd114869a8a943890f84b6a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:12:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:12:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0e71da54a3522462a23874baccf5bdded27cc985fcd114869a8a943890f84b6a"}
{"level":"info","ts":"2026-07-09T18:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0e71da54a3522462a23874baccf5bdded27cc985fcd114869a8a943890f84b6a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"630443086a8fe9129fe13572df10ed4db5acb8b00e255b5e462267f7d8133de8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:12:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:12:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/630443086a8fe9129fe13572df10ed4db5acb8b00e255b5e462267f7d8133de8"}
{"level":"info","ts":"2026-07-09T18:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"630443086a8fe9129fe13572df10ed4db5acb8b00e255b5e462267f7d8133de8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0e71da54a3522462a23874baccf5bdded27cc985fcd114869a8a943890f84b6a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"630443086a8fe9129fe13572df10ed4db5acb8b00e255b5e462267f7d8133de8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:12:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:12:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["630443086a8fe9129fe13572df10ed4db5acb8b00e255b5e462267f7d8133de8"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"630443086a8fe9129fe13572df10ed4db5acb8b00e255b5e462267f7d8133de8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0e71da54a3522462a23874baccf5bdded27cc985fcd114869a8a943890f84b6a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ad720c037b2c267a80e7d606d4a15e99b511408406fad284e586d10c8d04afbb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:12:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:12:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ad720c037b2c267a80e7d606d4a15e99b511408406fad284e586d10c8d04afbb"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0e71da54a3522462a23874baccf5bdded27cc985fcd114869a8a943890f84b6a"}
{"level":"info","ts":"2026-07-09T18:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ad720c037b2c267a80e7d606d4a15e99b511408406fad284e586d10c8d04afbb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"630443086a8fe9129fe13572df10ed4db5acb8b00e255b5e462267f7d8133de8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:12:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:12:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"630443086a8fe9129fe13572df10ed4db5acb8b00e255b5e462267f7d8133de8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ad720c037b2c267a80e7d606d4a15e99b511408406fad284e586d10c8d04afbb","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/630443086a8fe9129fe13572df10ed4db5acb8b00e255b5e462267f7d8133de8"}
{"level":"debug","ts":"2026-07-09T18:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"630443086a8fe9129fe13572df10ed4db5acb8b00e255b5e462267f7d8133de8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:12:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:12:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["630443086a8fe9129fe13572df10ed4db5acb8b00e255b5e462267f7d8133de8"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"630443086a8fe9129fe13572df10ed4db5acb8b00e255b5e462267f7d8133de8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"630443086a8fe9129fe13572df10ed4db5acb8b00e255b5e462267f7d8133de8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:12:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:12:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["630443086a8fe9129fe13572df10ed4db5acb8b00e255b5e462267f7d8133de8"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ad720c037b2c267a80e7d606d4a15e99b511408406fad284e586d10c8d04afbb"}
{"level":"error","ts":"2026-07-09T18:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"630443086a8fe9129fe13572df10ed4db5acb8b00e255b5e462267f7d8133de8","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"630443086a8fe9129fe13572df10ed4db5acb8b00e255b5e462267f7d8133de8\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-09T18:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"630443086a8fe9129fe13572df10ed4db5acb8b00e255b5e462267f7d8133de8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:12:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:12:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"630443086a8fe9129fe13572df10ed4db5acb8b00e255b5e462267f7d8133de8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"630443086a8fe9129fe13572df10ed4db5acb8b00e255b5e462267f7d8133de8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:12:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:12:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-09T18:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"630443086a8fe9129fe13572df10ed4db5acb8b00e255b5e462267f7d8133de8","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"630443086a8fe9129fe13572df10ed4db5acb8b00e255b5e462267f7d8133de8\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-09T18:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"630443086a8fe9129fe13572df10ed4db5acb8b00e255b5e462267f7d8133de8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"630443086a8fe9129fe13572df10ed4db5acb8b00e255b5e462267f7d8133de8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0e71da54a3522462a23874baccf5bdded27cc985fcd114869a8a943890f84b6a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:12:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:12:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["0e71da54a3522462a23874baccf5bdded27cc985fcd114869a8a943890f84b6a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/630443086a8fe9129fe13572df10ed4db5acb8b00e255b5e462267f7d8133de8"}
{"level":"info","ts":"2026-07-09T18:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0e71da54a3522462a23874baccf5bdded27cc985fcd114869a8a943890f84b6a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0e71da54a3522462a23874baccf5bdded27cc985fcd114869a8a943890f84b6a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/630443086a8fe9129fe13572df10ed4db5acb8b00e255b5e462267f7d8133de8"}
{"level":"debug","ts":"2026-07-09T18:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"630443086a8fe9129fe13572df10ed4db5acb8b00e255b5e462267f7d8133de8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:12:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:12:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["630443086a8fe9129fe13572df10ed4db5acb8b00e255b5e462267f7d8133de8"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0e71da54a3522462a23874baccf5bdded27cc985fcd114869a8a943890f84b6a"}
{"level":"info","ts":"2026-07-09T18:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"630443086a8fe9129fe13572df10ed4db5acb8b00e255b5e462267f7d8133de8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"630443086a8fe9129fe13572df10ed4db5acb8b00e255b5e462267f7d8133de8","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/630443086a8fe9129fe13572df10ed4db5acb8b00e255b5e462267f7d8133de8"}
{"level":"debug","ts":"2026-07-09T18:12:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3d3fdd54ab27fbb20386fddf8f228d46ff28bc28ce5b3e174227e7c701839bff","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:12:33Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:12:33Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:12:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3d3fdd54ab27fbb20386fddf8f228d46ff28bc28ce5b3e174227e7c701839bff","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3d3fdd54ab27fbb20386fddf8f228d46ff28bc28ce5b3e174227e7c701839bff","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3d3fdd54ab27fbb20386fddf8f228d46ff28bc28ce5b3e174227e7c701839bff","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:12:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3d3fdd54ab27fbb20386fddf8f228d46ff28bc28ce5b3e174227e7c701839bff"}
{"level":"debug","ts":"2026-07-09T18:12:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3d3fdd54ab27fbb20386fddf8f228d46ff28bc28ce5b3e174227e7c701839bff","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:12:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3d3fdd54ab27fbb20386fddf8f228d46ff28bc28ce5b3e174227e7c701839bff"}
{"level":"debug","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3d3fdd54ab27fbb20386fddf8f228d46ff28bc28ce5b3e174227e7c701839bff","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:12:34Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:12:34Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3d3fdd54ab27fbb20386fddf8f228d46ff28bc28ce5b3e174227e7c701839bff"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3d3fdd54ab27fbb20386fddf8f228d46ff28bc28ce5b3e174227e7c701839bff","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3d3fdd54ab27fbb20386fddf8f228d46ff28bc28ce5b3e174227e7c701839bff","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:12:34Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:12:34Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3d3fdd54ab27fbb20386fddf8f228d46ff28bc28ce5b3e174227e7c701839bff","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"da41b07f92d255d3238b29ad30df8c0ee8a4fe5642aa41d9956e7ed89f5cb3bc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3d3fdd54ab27fbb20386fddf8f228d46ff28bc28ce5b3e174227e7c701839bff","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3d3fdd54ab27fbb20386fddf8f228d46ff28bc28ce5b3e174227e7c701839bff","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3d3fdd54ab27fbb20386fddf8f228d46ff28bc28ce5b3e174227e7c701839bff"}
{"level":"debug","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3d3fdd54ab27fbb20386fddf8f228d46ff28bc28ce5b3e174227e7c701839bff","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:12:34Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:12:34Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3d3fdd54ab27fbb20386fddf8f228d46ff28bc28ce5b3e174227e7c701839bff"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/da41b07f92d255d3238b29ad30df8c0ee8a4fe5642aa41d9956e7ed89f5cb3bc"}
{"level":"info","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3d3fdd54ab27fbb20386fddf8f228d46ff28bc28ce5b3e174227e7c701839bff","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3d3fdd54ab27fbb20386fddf8f228d46ff28bc28ce5b3e174227e7c701839bff","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:12:34Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:12:34Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3d3fdd54ab27fbb20386fddf8f228d46ff28bc28ce5b3e174227e7c701839bff"}
{"level":"info","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3d3fdd54ab27fbb20386fddf8f228d46ff28bc28ce5b3e174227e7c701839bff","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3d3fdd54ab27fbb20386fddf8f228d46ff28bc28ce5b3e174227e7c701839bff","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3d3fdd54ab27fbb20386fddf8f228d46ff28bc28ce5b3e174227e7c701839bff","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3d3fdd54ab27fbb20386fddf8f228d46ff28bc28ce5b3e174227e7c701839bff"}
{"level":"debug","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3d3fdd54ab27fbb20386fddf8f228d46ff28bc28ce5b3e174227e7c701839bff","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3682972e0c81bfc88ef826fc0824c34a3a6f73b8888ffa4426c86a341dd9b2cc","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3d3fdd54ab27fbb20386fddf8f228d46ff28bc28ce5b3e174227e7c701839bff"}
{"level":"info","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3682972e0c81bfc88ef826fc0824c34a3a6f73b8888ffa4426c86a341dd9b2cc"}
{"level":"debug","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3d3fdd54ab27fbb20386fddf8f228d46ff28bc28ce5b3e174227e7c701839bff","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:12:34Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:12:34Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3d3fdd54ab27fbb20386fddf8f228d46ff28bc28ce5b3e174227e7c701839bff"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3d3fdd54ab27fbb20386fddf8f228d46ff28bc28ce5b3e174227e7c701839bff","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3d3fdd54ab27fbb20386fddf8f228d46ff28bc28ce5b3e174227e7c701839bff","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:12:34Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:12:34Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3d3fdd54ab27fbb20386fddf8f228d46ff28bc28ce5b3e174227e7c701839bff","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3d3fdd54ab27fbb20386fddf8f228d46ff28bc28ce5b3e174227e7c701839bff","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3d3fdd54ab27fbb20386fddf8f228d46ff28bc28ce5b3e174227e7c701839bff","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3d3fdd54ab27fbb20386fddf8f228d46ff28bc28ce5b3e174227e7c701839bff"}
{"level":"debug","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3d3fdd54ab27fbb20386fddf8f228d46ff28bc28ce5b3e174227e7c701839bff","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3d3fdd54ab27fbb20386fddf8f228d46ff28bc28ce5b3e174227e7c701839bff"}
{"level":"debug","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ad720c037b2c267a80e7d606d4a15e99b511408406fad284e586d10c8d04afbb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:12:34Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:12:34Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ad720c037b2c267a80e7d606d4a15e99b511408406fad284e586d10c8d04afbb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ad720c037b2c267a80e7d606d4a15e99b511408406fad284e586d10c8d04afbb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ad720c037b2c267a80e7d606d4a15e99b511408406fad284e586d10c8d04afbb","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ad720c037b2c267a80e7d606d4a15e99b511408406fad284e586d10c8d04afbb"}
{"level":"debug","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3d3fdd54ab27fbb20386fddf8f228d46ff28bc28ce5b3e174227e7c701839bff","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:12:34Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:12:34Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3d3fdd54ab27fbb20386fddf8f228d46ff28bc28ce5b3e174227e7c701839bff"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3d3fdd54ab27fbb20386fddf8f228d46ff28bc28ce5b3e174227e7c701839bff","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ad720c037b2c267a80e7d606d4a15e99b511408406fad284e586d10c8d04afbb","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ad720c037b2c267a80e7d606d4a15e99b511408406fad284e586d10c8d04afbb"}
{"level":"debug","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3d3fdd54ab27fbb20386fddf8f228d46ff28bc28ce5b3e174227e7c701839bff","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:12:34Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:12:34Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3d3fdd54ab27fbb20386fddf8f228d46ff28bc28ce5b3e174227e7c701839bff","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3d3fdd54ab27fbb20386fddf8f228d46ff28bc28ce5b3e174227e7c701839bff","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3d3fdd54ab27fbb20386fddf8f228d46ff28bc28ce5b3e174227e7c701839bff","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3d3fdd54ab27fbb20386fddf8f228d46ff28bc28ce5b3e174227e7c701839bff"}
{"level":"debug","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3d3fdd54ab27fbb20386fddf8f228d46ff28bc28ce5b3e174227e7c701839bff","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ad720c037b2c267a80e7d606d4a15e99b511408406fad284e586d10c8d04afbb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:12:34Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:12:34Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ad720c037b2c267a80e7d606d4a15e99b511408406fad284e586d10c8d04afbb"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3d3fdd54ab27fbb20386fddf8f228d46ff28bc28ce5b3e174227e7c701839bff"}
{"level":"info","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ad720c037b2c267a80e7d606d4a15e99b511408406fad284e586d10c8d04afbb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ad720c037b2c267a80e7d606d4a15e99b511408406fad284e586d10c8d04afbb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:12:34Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:12:34Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ad720c037b2c267a80e7d606d4a15e99b511408406fad284e586d10c8d04afbb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ad720c037b2c267a80e7d606d4a15e99b511408406fad284e586d10c8d04afbb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ad720c037b2c267a80e7d606d4a15e99b511408406fad284e586d10c8d04afbb","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ad720c037b2c267a80e7d606d4a15e99b511408406fad284e586d10c8d04afbb"}
{"level":"debug","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3d3fdd54ab27fbb20386fddf8f228d46ff28bc28ce5b3e174227e7c701839bff","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:12:34Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:12:34Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3d3fdd54ab27fbb20386fddf8f228d46ff28bc28ce5b3e174227e7c701839bff"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3d3fdd54ab27fbb20386fddf8f228d46ff28bc28ce5b3e174227e7c701839bff","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ad720c037b2c267a80e7d606d4a15e99b511408406fad284e586d10c8d04afbb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3d3fdd54ab27fbb20386fddf8f228d46ff28bc28ce5b3e174227e7c701839bff","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ad720c037b2c267a80e7d606d4a15e99b511408406fad284e586d10c8d04afbb"}
{"level":"info","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3d3fdd54ab27fbb20386fddf8f228d46ff28bc28ce5b3e174227e7c701839bff"}
{"level":"debug","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ad720c037b2c267a80e7d606d4a15e99b511408406fad284e586d10c8d04afbb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:12:34Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:12:34Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ad720c037b2c267a80e7d606d4a15e99b511408406fad284e586d10c8d04afbb"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ad720c037b2c267a80e7d606d4a15e99b511408406fad284e586d10c8d04afbb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ad720c037b2c267a80e7d606d4a15e99b511408406fad284e586d10c8d04afbb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"02eaa43f5a2e2680e3123f4f54d112cacb1c868e28aedc7217e87d2b21a5701f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ad720c037b2c267a80e7d606d4a15e99b511408406fad284e586d10c8d04afbb"}
{"level":"info","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/02eaa43f5a2e2680e3123f4f54d112cacb1c868e28aedc7217e87d2b21a5701f"}
{"level":"debug","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3b3177991297fdbae2c007ceba4a843cc4cee6ffb746764254c1b3c63519840e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:12:34Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:12:34Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3b3177991297fdbae2c007ceba4a843cc4cee6ffb746764254c1b3c63519840e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3b3177991297fdbae2c007ceba4a843cc4cee6ffb746764254c1b3c63519840e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3b3177991297fdbae2c007ceba4a843cc4cee6ffb746764254c1b3c63519840e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3b3177991297fdbae2c007ceba4a843cc4cee6ffb746764254c1b3c63519840e"}
{"level":"debug","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3b3177991297fdbae2c007ceba4a843cc4cee6ffb746764254c1b3c63519840e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3b3177991297fdbae2c007ceba4a843cc4cee6ffb746764254c1b3c63519840e"}
{"level":"debug","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3b3177991297fdbae2c007ceba4a843cc4cee6ffb746764254c1b3c63519840e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:12:34Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:12:34Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3b3177991297fdbae2c007ceba4a843cc4cee6ffb746764254c1b3c63519840e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3b3177991297fdbae2c007ceba4a843cc4cee6ffb746764254c1b3c63519840e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3b3177991297fdbae2c007ceba4a843cc4cee6ffb746764254c1b3c63519840e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:12:34Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:12:34Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3b3177991297fdbae2c007ceba4a843cc4cee6ffb746764254c1b3c63519840e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8769041950444089e8e236502ddb0dc67357a96fee3199cfc9770eb49cdf8d8a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3b3177991297fdbae2c007ceba4a843cc4cee6ffb746764254c1b3c63519840e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3b3177991297fdbae2c007ceba4a843cc4cee6ffb746764254c1b3c63519840e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3b3177991297fdbae2c007ceba4a843cc4cee6ffb746764254c1b3c63519840e"}
{"level":"debug","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3b3177991297fdbae2c007ceba4a843cc4cee6ffb746764254c1b3c63519840e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:12:34Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:12:34Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3b3177991297fdbae2c007ceba4a843cc4cee6ffb746764254c1b3c63519840e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8769041950444089e8e236502ddb0dc67357a96fee3199cfc9770eb49cdf8d8a"}
{"level":"info","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3b3177991297fdbae2c007ceba4a843cc4cee6ffb746764254c1b3c63519840e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3b3177991297fdbae2c007ceba4a843cc4cee6ffb746764254c1b3c63519840e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:12:34Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:12:34Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3b3177991297fdbae2c007ceba4a843cc4cee6ffb746764254c1b3c63519840e"}
{"level":"info","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3b3177991297fdbae2c007ceba4a843cc4cee6ffb746764254c1b3c63519840e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3b3177991297fdbae2c007ceba4a843cc4cee6ffb746764254c1b3c63519840e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3b3177991297fdbae2c007ceba4a843cc4cee6ffb746764254c1b3c63519840e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3b3177991297fdbae2c007ceba4a843cc4cee6ffb746764254c1b3c63519840e"}
{"level":"debug","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3b3177991297fdbae2c007ceba4a843cc4cee6ffb746764254c1b3c63519840e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3b3177991297fdbae2c007ceba4a843cc4cee6ffb746764254c1b3c63519840e"}
{"level":"debug","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3b3177991297fdbae2c007ceba4a843cc4cee6ffb746764254c1b3c63519840e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:12:34Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:12:34Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3b3177991297fdbae2c007ceba4a843cc4cee6ffb746764254c1b3c63519840e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3b3177991297fdbae2c007ceba4a843cc4cee6ffb746764254c1b3c63519840e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3b3177991297fdbae2c007ceba4a843cc4cee6ffb746764254c1b3c63519840e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:12:34Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:12:34Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3b3177991297fdbae2c007ceba4a843cc4cee6ffb746764254c1b3c63519840e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3b3177991297fdbae2c007ceba4a843cc4cee6ffb746764254c1b3c63519840e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3b3177991297fdbae2c007ceba4a843cc4cee6ffb746764254c1b3c63519840e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3b3177991297fdbae2c007ceba4a843cc4cee6ffb746764254c1b3c63519840e"}
{"level":"debug","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3b3177991297fdbae2c007ceba4a843cc4cee6ffb746764254c1b3c63519840e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3b3177991297fdbae2c007ceba4a843cc4cee6ffb746764254c1b3c63519840e"}
{"level":"debug","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9b729fee5f198546b25447d43f6aac3c5d2da0ab25e3729b865bc3257e29673a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:12:34Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:12:34Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9b729fee5f198546b25447d43f6aac3c5d2da0ab25e3729b865bc3257e29673a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9b729fee5f198546b25447d43f6aac3c5d2da0ab25e3729b865bc3257e29673a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f64647ce051a7330f99fefec1c3f76a918776ea681a2aea475dbf953ef700840","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9b729fee5f198546b25447d43f6aac3c5d2da0ab25e3729b865bc3257e29673a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9b729fee5f198546b25447d43f6aac3c5d2da0ab25e3729b865bc3257e29673a"}
{"level":"debug","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3b3177991297fdbae2c007ceba4a843cc4cee6ffb746764254c1b3c63519840e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:12:34Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:12:34Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3b3177991297fdbae2c007ceba4a843cc4cee6ffb746764254c1b3c63519840e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f64647ce051a7330f99fefec1c3f76a918776ea681a2aea475dbf953ef700840"}
{"level":"info","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3b3177991297fdbae2c007ceba4a843cc4cee6ffb746764254c1b3c63519840e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9b729fee5f198546b25447d43f6aac3c5d2da0ab25e3729b865bc3257e29673a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3b3177991297fdbae2c007ceba4a843cc4cee6ffb746764254c1b3c63519840e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9b729fee5f198546b25447d43f6aac3c5d2da0ab25e3729b865bc3257e29673a"}
{"level":"info","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3b3177991297fdbae2c007ceba4a843cc4cee6ffb746764254c1b3c63519840e"}
{"level":"debug","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9b729fee5f198546b25447d43f6aac3c5d2da0ab25e3729b865bc3257e29673a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:12:34Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:12:34Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9b729fee5f198546b25447d43f6aac3c5d2da0ab25e3729b865bc3257e29673a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9b729fee5f198546b25447d43f6aac3c5d2da0ab25e3729b865bc3257e29673a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d8e0850808cc3464b9bc0513c8149e79e80d6d1342e3ad0fcb38a541c9d49a0d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:12:34Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:12:34Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d8e0850808cc3464b9bc0513c8149e79e80d6d1342e3ad0fcb38a541c9d49a0d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9b729fee5f198546b25447d43f6aac3c5d2da0ab25e3729b865bc3257e29673a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d8e0850808cc3464b9bc0513c8149e79e80d6d1342e3ad0fcb38a541c9d49a0d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d8e0850808cc3464b9bc0513c8149e79e80d6d1342e3ad0fcb38a541c9d49a0d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"866365b517230ea961a3d6f3740db5f55c33a9de2227f68a2a72be61a0d3827a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d8e0850808cc3464b9bc0513c8149e79e80d6d1342e3ad0fcb38a541c9d49a0d"}
{"level":"debug","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a9654cb6027e4278b1c6f8ee10580366de223cb20b25d8844184d6989a75fc81","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d8e0850808cc3464b9bc0513c8149e79e80d6d1342e3ad0fcb38a541c9d49a0d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:12:34Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:12:34Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d8e0850808cc3464b9bc0513c8149e79e80d6d1342e3ad0fcb38a541c9d49a0d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9b729fee5f198546b25447d43f6aac3c5d2da0ab25e3729b865bc3257e29673a"}
{"level":"info","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d8e0850808cc3464b9bc0513c8149e79e80d6d1342e3ad0fcb38a541c9d49a0d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d8e0850808cc3464b9bc0513c8149e79e80d6d1342e3ad0fcb38a541c9d49a0d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:12:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/866365b517230ea961a3d6f3740db5f55c33a9de2227f68a2a72be61a0d3827a"}
{"level":"info","ts":"2026-07-09T18:12:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d8e0850808cc3464b9bc0513c8149e79e80d6d1342e3ad0fcb38a541c9d49a0d"}
{"level":"debug","ts":"2026-07-09T18:12:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fb4e550f37dba2ea991739d1c620608c004f67ff25fd7c1b3579ae7b8447f4b6","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:12:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a9654cb6027e4278b1c6f8ee10580366de223cb20b25d8844184d6989a75fc81"}
{"level":"debug","ts":"2026-07-09T18:12:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d9bdad4f2209ade368fb8e3e9899aed674691a49f320a4c7056f5befc66c4d25","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0e71da54a3522462a23874baccf5bdded27cc985fcd114869a8a943890f84b6a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:12:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fb4e550f37dba2ea991739d1c620608c004f67ff25fd7c1b3579ae7b8447f4b6"}
{"level":"debug","ts":"2026-07-09T18:12:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"553875db3815210b31a2b9cbd05f78726f1df4c7e67b92603ab0923dbceaa720","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:12:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d9bdad4f2209ade368fb8e3e9899aed674691a49f320a4c7056f5befc66c4d25"}
{"level":"debug","ts":"2026-07-09T18:12:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"64b93b6206c99cbcd672a1a996cf76d848800c7648b57bbb11d6f2e590f078b6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"630443086a8fe9129fe13572df10ed4db5acb8b00e255b5e462267f7d8133de8","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:12:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0e71da54a3522462a23874baccf5bdded27cc985fcd114869a8a943890f84b6a"}
{"level":"debug","ts":"2026-07-09T18:12:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"350f30307fa8a522d626be3aadaa02be810be0a3d2401c3ac213850d0e198baf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d0dc982a4b2bb71b26b48cdc76131f83b5c5ef6691a5682c984d9c772913a6de","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:12:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/553875db3815210b31a2b9cbd05f78726f1df4c7e67b92603ab0923dbceaa720"}
{"level":"debug","ts":"2026-07-09T18:12:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"05a24a615559c5b6eef4df23ca30ca5c56c8d22d7ce704871ed3968ae23d60c9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6fff71fcd45a294412257cdd7721672479b46bddf883bead293812798aca2799","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:12:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"32492ba5e2ed30b35c1f4021a3bae59a250c5b47879a3c708ce6518c7d0ff6e0","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:12:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/64b93b6206c99cbcd672a1a996cf76d848800c7648b57bbb11d6f2e590f078b6"}
{"level":"debug","ts":"2026-07-09T18:12:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1c22386d7a88996965a2fe2a3b6c21237f9567e5526396d024ba3786aafe6b9f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:12:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/630443086a8fe9129fe13572df10ed4db5acb8b00e255b5e462267f7d8133de8"}
{"level":"info","ts":"2026-07-09T18:12:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/350f30307fa8a522d626be3aadaa02be810be0a3d2401c3ac213850d0e198baf"}
{"level":"info","ts":"2026-07-09T18:12:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d0dc982a4b2bb71b26b48cdc76131f83b5c5ef6691a5682c984d9c772913a6de"}
{"level":"info","ts":"2026-07-09T18:12:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/05a24a615559c5b6eef4df23ca30ca5c56c8d22d7ce704871ed3968ae23d60c9"}
{"level":"info","ts":"2026-07-09T18:12:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6fff71fcd45a294412257cdd7721672479b46bddf883bead293812798aca2799"}
{"level":"info","ts":"2026-07-09T18:12:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/32492ba5e2ed30b35c1f4021a3bae59a250c5b47879a3c708ce6518c7d0ff6e0"}
{"level":"info","ts":"2026-07-09T18:12:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1c22386d7a88996965a2fe2a3b6c21237f9567e5526396d024ba3786aafe6b9f"}
{"level":"info","ts":"2026-07-09T18:12:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6e2dab13-853a-4882-8ff7-16fea58019fb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:59114","PortSpecifier":{"PortValue":59114}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6e2dab13-853a-4882-8ff7-16fea58019fb","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-09d279.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T18:12:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6e2dab13-853a-4882-8ff7-16fea58019fb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:59114","PortSpecifier":{"PortValue":59114}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783620758,"nanos":282806159},"http":{"id":"6e2dab13-853a-4882-8ff7-16fea58019fb","method":"POST","headers":{":authority":"e2e-shared-a-09d279.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:12:38Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"6e2dab13-853a-4882-8ff7-16fea58019fb","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T18:12:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6e2dab13-853a-4882-8ff7-16fea58019fb","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"8a03aca8-c185-4c8a-b6bd-33878f9e863c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=d0cd2685-b2e1-4705-9a11-a82c8e44ad44"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab31c6ab9b00"]}}
{"level":"debug","ts":"2026-07-09T18:12:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6e2dab13-853a-4882-8ff7-16fea58019fb","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab31c6ab9b00"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=d0cd2685-b2e1-4705-9a11-a82c8e44ad44"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"8a03aca8-c185-4c8a-b6bd-33878f9e863c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"6fff71fcd45a294412257cdd7721672479b46bddf883bead293812798aca2799"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.47:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-09d279.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:12:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6e2dab13-853a-4882-8ff7-16fea58019fb","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:12:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6e2dab13-853a-4882-8ff7-16fea58019fb","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:12:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6e2dab13-853a-4882-8ff7-16fea58019fb","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-09d279/sub-test-model-09d279\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:12:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"6e2dab13-853a-4882-8ff7-16fea58019fb","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T18:12:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6e2dab13-853a-4882-8ff7-16fea58019fb","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T18:12:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6e2dab13-853a-4882-8ff7-16fea58019fb","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T18:12:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6e2dab13-853a-4882-8ff7-16fea58019fb","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T18:12:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6e2dab13-853a-4882-8ff7-16fea58019fb","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T18:12:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"21b42436-a7e0-4f87-af88-e9d267d00537","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:56050","PortSpecifier":{"PortValue":56050}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"21b42436-a7e0-4f87-af88-e9d267d00537","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-e0b9f9.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T18:12:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"21b42436-a7e0-4f87-af88-e9d267d00537","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:56050","PortSpecifier":{"PortValue":56050}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783620758,"nanos":322366217},"http":{"id":"21b42436-a7e0-4f87-af88-e9d267d00537","method":"POST","headers":{":authority":"e2e-shared-b-e0b9f9.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:12:38Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"21b42436-a7e0-4f87-af88-e9d267d00537","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T18:12:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"21b42436-a7e0-4f87-af88-e9d267d00537","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"8a03aca8-c185-4c8a-b6bd-33878f9e863c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=d0cd2685-b2e1-4705-9a11-a82c8e44ad44"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab31c6ab9b00"]}}
{"level":"debug","ts":"2026-07-09T18:12:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"21b42436-a7e0-4f87-af88-e9d267d00537","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab31c6ab9b00"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=d0cd2685-b2e1-4705-9a11-a82c8e44ad44"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"8a03aca8-c185-4c8a-b6bd-33878f9e863c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"3682972e0c81bfc88ef826fc0824c34a3a6f73b8888ffa4426c86a341dd9b2cc"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.48:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-e0b9f9.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:12:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"21b42436-a7e0-4f87-af88-e9d267d00537","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:12:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"21b42436-a7e0-4f87-af88-e9d267d00537","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:12:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"21b42436-a7e0-4f87-af88-e9d267d00537","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-e0b9f9/sub-test-model-e0b9f9\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:12:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"21b42436-a7e0-4f87-af88-e9d267d00537","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T18:12:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"21b42436-a7e0-4f87-af88-e9d267d00537","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T18:12:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"21b42436-a7e0-4f87-af88-e9d267d00537","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T18:12:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"21b42436-a7e0-4f87-af88-e9d267d00537","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T18:12:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"21b42436-a7e0-4f87-af88-e9d267d00537","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T18:12:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c576ad58-fae9-449b-b78f-8f4c447041e4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:59126","PortSpecifier":{"PortValue":59126}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c576ad58-fae9-449b-b78f-8f4c447041e4","method":"GET","path":"/maas-api/v1/subscriptions","host":"e2e-shared-a-09d279.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T18:12:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c576ad58-fae9-449b-b78f-8f4c447041e4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:59126","PortSpecifier":{"PortValue":59126}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783620758,"nanos":358143579},"http":{"id":"c576ad58-fae9-449b-b78f-8f4c447041e4","method":"GET","headers":{":authority":"e2e-shared-a-09d279.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/subscriptions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:12:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"c576ad58-fae9-449b-b78f-8f4c447041e4","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-8IdOclMiD4SIcOTi_BlI8dfqBlxmHpS5ZvLojMfnpd1aHDBvWIFgl8747GCb"}
{"level":"debug","ts":"2026-07-09T18:12:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c576ad58-fae9-449b-b78f-8f4c447041e4","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-09d279.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-8IdOclMiD4SIcOTi_BlI8dfqBlxmHpS5ZvLojMfnpd1aHDBvWIFgl8747GCb\"}"}
{"level":"debug","ts":"2026-07-09T18:12:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c576ad58-fae9-449b-b78f-8f4c447041e4","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-09d279.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"903d8fae-2665-441f-b47f-991346431eb3","keyName":"e2e-sub-iso-5b4d51","subscription":"e2e-a-only-1bee43","tenant":"e2e-shared-a-09d279","userId":"903d8fae-2665-441f-b47f-991346431eb3","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T18:12:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"c576ad58-fae9-449b-b78f-8f4c447041e4","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:12:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c576ad58-fae9-449b-b78f-8f4c447041e4","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:12:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c576ad58-fae9-449b-b78f-8f4c447041e4","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:12:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c576ad58-fae9-449b-b78f-8f4c447041e4","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-09d279/sub-test-model-09d279\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:12:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c576ad58-fae9-449b-b78f-8f4c447041e4","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-a-only-1bee43"}
{"level":"debug","ts":"2026-07-09T18:12:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c576ad58-fae9-449b-b78f-8f4c447041e4","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T18:12:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c576ad58-fae9-449b-b78f-8f4c447041e4","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T18:12:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"c576ad58-fae9-449b-b78f-8f4c447041e4","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-09T18:12:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c576ad58-fae9-449b-b78f-8f4c447041e4","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T18:12:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c576ad58-fae9-449b-b78f-8f4c447041e4","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T18:12:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4b9fcd56-3984-4612-a15b-ec085edf4d95","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:56052","PortSpecifier":{"PortValue":56052}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"4b9fcd56-3984-4612-a15b-ec085edf4d95","method":"GET","path":"/maas-api/v1/subscriptions","host":"e2e-shared-b-e0b9f9.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T18:12:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4b9fcd56-3984-4612-a15b-ec085edf4d95","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:56052","PortSpecifier":{"PortValue":56052}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783620758,"nanos":395673407},"http":{"id":"4b9fcd56-3984-4612-a15b-ec085edf4d95","method":"GET","headers":{":authority":"e2e-shared-b-e0b9f9.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/subscriptions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:12:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"4b9fcd56-3984-4612-a15b-ec085edf4d95","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-13IZcJAgOLI5ZrT4h_UDxLfnuiZNUZEyqLpmclYUEilnU5YkPffNKaoepLiY1"}
{"level":"debug","ts":"2026-07-09T18:12:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"4b9fcd56-3984-4612-a15b-ec085edf4d95","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-e0b9f9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-13IZcJAgOLI5ZrT4h_UDxLfnuiZNUZEyqLpmclYUEilnU5YkPffNKaoepLiY1\"}"}
{"level":"debug","ts":"2026-07-09T18:12:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"4b9fcd56-3984-4612-a15b-ec085edf4d95","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-e0b9f9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"78a9aedc-7b5f-4781-8d70-191f5a5822e5","keyName":"e2e-sub-iso-7c91ea","subscription":"e2e-b-only-1bee43","tenant":"e2e-shared-b-e0b9f9","userId":"78a9aedc-7b5f-4781-8d70-191f5a5822e5","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T18:12:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"4b9fcd56-3984-4612-a15b-ec085edf4d95","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:12:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4b9fcd56-3984-4612-a15b-ec085edf4d95","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:12:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4b9fcd56-3984-4612-a15b-ec085edf4d95","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:12:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4b9fcd56-3984-4612-a15b-ec085edf4d95","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-e0b9f9/sub-test-model-e0b9f9\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:12:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4b9fcd56-3984-4612-a15b-ec085edf4d95","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-b-only-1bee43"}
{"level":"debug","ts":"2026-07-09T18:12:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"4b9fcd56-3984-4612-a15b-ec085edf4d95","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-09T18:12:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4b9fcd56-3984-4612-a15b-ec085edf4d95","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T18:12:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4b9fcd56-3984-4612-a15b-ec085edf4d95","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T18:12:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4b9fcd56-3984-4612-a15b-ec085edf4d95","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T18:12:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4b9fcd56-3984-4612-a15b-ec085edf4d95","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T18:12:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"906ef655-125e-4aaa-b366-f56c4b3b2d13","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:55228","PortSpecifier":{"PortValue":55228}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"906ef655-125e-4aaa-b366-f56c4b3b2d13","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-09d279.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T18:12:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"906ef655-125e-4aaa-b366-f56c4b3b2d13","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:55228","PortSpecifier":{"PortValue":55228}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783620777,"nanos":215202419},"http":{"id":"906ef655-125e-4aaa-b366-f56c4b3b2d13","method":"POST","headers":{":authority":"e2e-shared-a-09d279.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:12:57Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"906ef655-125e-4aaa-b366-f56c4b3b2d13","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T18:12:57Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"906ef655-125e-4aaa-b366-f56c4b3b2d13","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"8a03aca8-c185-4c8a-b6bd-33878f9e863c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=d0cd2685-b2e1-4705-9a11-a82c8e44ad44"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab31c6ab9b00"]}}
{"level":"debug","ts":"2026-07-09T18:12:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"906ef655-125e-4aaa-b366-f56c4b3b2d13","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab31c6ab9b00"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=d0cd2685-b2e1-4705-9a11-a82c8e44ad44"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"8a03aca8-c185-4c8a-b6bd-33878f9e863c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"6fff71fcd45a294412257cdd7721672479b46bddf883bead293812798aca2799"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.47:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-09d279.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:12:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"906ef655-125e-4aaa-b366-f56c4b3b2d13","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:12:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"906ef655-125e-4aaa-b366-f56c4b3b2d13","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:12:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"906ef655-125e-4aaa-b366-f56c4b3b2d13","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-09d279/sub-test-model-09d279\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:12:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"906ef655-125e-4aaa-b366-f56c4b3b2d13","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T18:12:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"906ef655-125e-4aaa-b366-f56c4b3b2d13","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T18:12:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"906ef655-125e-4aaa-b366-f56c4b3b2d13","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T18:12:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"906ef655-125e-4aaa-b366-f56c4b3b2d13","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T18:12:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"906ef655-125e-4aaa-b366-f56c4b3b2d13","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T18:12:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0ce26ea0-6128-4da1-a8f9-463266bef5c0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:35376","PortSpecifier":{"PortValue":35376}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0ce26ea0-6128-4da1-a8f9-463266bef5c0","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-e0b9f9.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T18:12:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0ce26ea0-6128-4da1-a8f9-463266bef5c0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:35376","PortSpecifier":{"PortValue":35376}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783620777,"nanos":247875853},"http":{"id":"0ce26ea0-6128-4da1-a8f9-463266bef5c0","method":"POST","headers":{":authority":"e2e-shared-b-e0b9f9.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:12:57Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"0ce26ea0-6128-4da1-a8f9-463266bef5c0","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T18:12:57Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0ce26ea0-6128-4da1-a8f9-463266bef5c0","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"8a03aca8-c185-4c8a-b6bd-33878f9e863c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=d0cd2685-b2e1-4705-9a11-a82c8e44ad44"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab31c6ab9b00"]}}
{"level":"debug","ts":"2026-07-09T18:12:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0ce26ea0-6128-4da1-a8f9-463266bef5c0","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab31c6ab9b00"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=d0cd2685-b2e1-4705-9a11-a82c8e44ad44"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"8a03aca8-c185-4c8a-b6bd-33878f9e863c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"3682972e0c81bfc88ef826fc0824c34a3a6f73b8888ffa4426c86a341dd9b2cc"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.48:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-e0b9f9.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:12:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0ce26ea0-6128-4da1-a8f9-463266bef5c0","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:12:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0ce26ea0-6128-4da1-a8f9-463266bef5c0","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:12:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0ce26ea0-6128-4da1-a8f9-463266bef5c0","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-e0b9f9/sub-test-model-e0b9f9\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:12:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"0ce26ea0-6128-4da1-a8f9-463266bef5c0","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T18:12:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0ce26ea0-6128-4da1-a8f9-463266bef5c0","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T18:12:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0ce26ea0-6128-4da1-a8f9-463266bef5c0","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T18:12:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0ce26ea0-6128-4da1-a8f9-463266bef5c0","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T18:12:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0ce26ea0-6128-4da1-a8f9-463266bef5c0","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T18:12:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9122f6be-9ece-4197-a179-c9bbf0be7719","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:55236","PortSpecifier":{"PortValue":55236}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9122f6be-9ece-4197-a179-c9bbf0be7719","method":"POST","path":"/maas-api/internal/v1/subscriptions/select","host":"e2e-shared-a-09d279.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T18:12:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9122f6be-9ece-4197-a179-c9bbf0be7719","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:55236","PortSpecifier":{"PortValue":55236}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783620777,"nanos":285269614},"http":{"id":"9122f6be-9ece-4197-a179-c9bbf0be7719","method":"POST","headers":{":authority":"e2e-shared-a-09d279.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/internal/v1/subscriptions/select",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:12:57Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9122f6be-9ece-4197-a179-c9bbf0be7719","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1XjDevfYxcStrl0c8_XqW4RGnVYQjXktJN2P1rdodl4ED0G2RJR95UQ4LWyKQ"}
{"level":"debug","ts":"2026-07-09T18:12:57Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9122f6be-9ece-4197-a179-c9bbf0be7719","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-09d279.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1XjDevfYxcStrl0c8_XqW4RGnVYQjXktJN2P1rdodl4ED0G2RJR95UQ4LWyKQ\"}"}
{"level":"debug","ts":"2026-07-09T18:12:57Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9122f6be-9ece-4197-a179-c9bbf0be7719","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-09d279.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"b8db5b33-72bf-4557-9c33-1ac8d0fc459c","keyName":"e2e-sub-iso-753956","subscription":"e2e-shared-sub-b101b1","tenant":"e2e-shared-a-09d279","userId":"b8db5b33-72bf-4557-9c33-1ac8d0fc459c","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T18:12:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9122f6be-9ece-4197-a179-c9bbf0be7719","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:12:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9122f6be-9ece-4197-a179-c9bbf0be7719","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:12:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9122f6be-9ece-4197-a179-c9bbf0be7719","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:12:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9122f6be-9ece-4197-a179-c9bbf0be7719","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-09d279/sub-test-model-09d279\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:12:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9122f6be-9ece-4197-a179-c9bbf0be7719","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T18:12:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9122f6be-9ece-4197-a179-c9bbf0be7719","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-shared-sub-b101b1"}
{"level":"debug","ts":"2026-07-09T18:12:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9122f6be-9ece-4197-a179-c9bbf0be7719","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T18:12:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"9122f6be-9ece-4197-a179-c9bbf0be7719","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-09T18:12:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9122f6be-9ece-4197-a179-c9bbf0be7719","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T18:12:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9122f6be-9ece-4197-a179-c9bbf0be7719","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T18:12:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"afa57db3-9c57-483c-af3a-20fe2ad56ffd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:35386","PortSpecifier":{"PortValue":35386}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"afa57db3-9c57-483c-af3a-20fe2ad56ffd","method":"POST","path":"/maas-api/internal/v1/subscriptions/select","host":"e2e-shared-b-e0b9f9.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T18:12:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"afa57db3-9c57-483c-af3a-20fe2ad56ffd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:35386","PortSpecifier":{"PortValue":35386}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783620777,"nanos":313817424},"http":{"id":"afa57db3-9c57-483c-af3a-20fe2ad56ffd","method":"POST","headers":{":authority":"e2e-shared-b-e0b9f9.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/internal/v1/subscriptions/select",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:12:57Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"afa57db3-9c57-483c-af3a-20fe2ad56ffd","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1HVISAzjGUSK6ctPG_9wUcsy5gU8jrPFXwhUYASa8ya2UJXXs2q9InZ7QKEvN"}
{"level":"debug","ts":"2026-07-09T18:12:57Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"afa57db3-9c57-483c-af3a-20fe2ad56ffd","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-e0b9f9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1HVISAzjGUSK6ctPG_9wUcsy5gU8jrPFXwhUYASa8ya2UJXXs2q9InZ7QKEvN\"}"}
{"level":"debug","ts":"2026-07-09T18:12:57Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"afa57db3-9c57-483c-af3a-20fe2ad56ffd","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-e0b9f9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"13f9569e-c23e-401c-b3e6-584004103341","keyName":"e2e-sub-iso-5adee1","subscription":"e2e-shared-sub-b101b1","tenant":"e2e-shared-b-e0b9f9","userId":"13f9569e-c23e-401c-b3e6-584004103341","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T18:12:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"afa57db3-9c57-483c-af3a-20fe2ad56ffd","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:12:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"afa57db3-9c57-483c-af3a-20fe2ad56ffd","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:12:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"afa57db3-9c57-483c-af3a-20fe2ad56ffd","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:12:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"afa57db3-9c57-483c-af3a-20fe2ad56ffd","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-e0b9f9/sub-test-model-e0b9f9\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:12:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"afa57db3-9c57-483c-af3a-20fe2ad56ffd","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T18:12:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"afa57db3-9c57-483c-af3a-20fe2ad56ffd","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T18:12:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"afa57db3-9c57-483c-af3a-20fe2ad56ffd","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-09T18:12:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"afa57db3-9c57-483c-af3a-20fe2ad56ffd","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-shared-sub-b101b1"}
{"level":"info","ts":"2026-07-09T18:12:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"afa57db3-9c57-483c-af3a-20fe2ad56ffd","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T18:12:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"afa57db3-9c57-483c-af3a-20fe2ad56ffd","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d2c73e6df73ec2c6b7e8bcee8aeaa086e6784eb2f32fcdd5956c8c7a26a9f91f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:13:14Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:13:14Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d2c73e6df73ec2c6b7e8bcee8aeaa086e6784eb2f32fcdd5956c8c7a26a9f91f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d2c73e6df73ec2c6b7e8bcee8aeaa086e6784eb2f32fcdd5956c8c7a26a9f91f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d2c73e6df73ec2c6b7e8bcee8aeaa086e6784eb2f32fcdd5956c8c7a26a9f91f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d2c73e6df73ec2c6b7e8bcee8aeaa086e6784eb2f32fcdd5956c8c7a26a9f91f"}
{"level":"debug","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d2c73e6df73ec2c6b7e8bcee8aeaa086e6784eb2f32fcdd5956c8c7a26a9f91f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d2c73e6df73ec2c6b7e8bcee8aeaa086e6784eb2f32fcdd5956c8c7a26a9f91f"}
{"level":"debug","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d2c73e6df73ec2c6b7e8bcee8aeaa086e6784eb2f32fcdd5956c8c7a26a9f91f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:13:14Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:13:14Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d2c73e6df73ec2c6b7e8bcee8aeaa086e6784eb2f32fcdd5956c8c7a26a9f91f"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d2c73e6df73ec2c6b7e8bcee8aeaa086e6784eb2f32fcdd5956c8c7a26a9f91f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d2c73e6df73ec2c6b7e8bcee8aeaa086e6784eb2f32fcdd5956c8c7a26a9f91f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:13:14Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:13:14Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d2c73e6df73ec2c6b7e8bcee8aeaa086e6784eb2f32fcdd5956c8c7a26a9f91f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3551875117ccf3984c27a02b4864f4cd1c57e8ac94e5723b572e4ebbb2bcda9f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:13:14Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:13:14Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d2c73e6df73ec2c6b7e8bcee8aeaa086e6784eb2f32fcdd5956c8c7a26a9f91f"}
{"level":"info","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3551875117ccf3984c27a02b4864f4cd1c57e8ac94e5723b572e4ebbb2bcda9f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d2c73e6df73ec2c6b7e8bcee8aeaa086e6784eb2f32fcdd5956c8c7a26a9f91f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:13:14Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:13:14Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d2c73e6df73ec2c6b7e8bcee8aeaa086e6784eb2f32fcdd5956c8c7a26a9f91f"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d2c73e6df73ec2c6b7e8bcee8aeaa086e6784eb2f32fcdd5956c8c7a26a9f91f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3551875117ccf3984c27a02b4864f4cd1c57e8ac94e5723b572e4ebbb2bcda9f"}
{"level":"debug","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3551875117ccf3984c27a02b4864f4cd1c57e8ac94e5723b572e4ebbb2bcda9f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:13:14Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:13:14Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3551875117ccf3984c27a02b4864f4cd1c57e8ac94e5723b572e4ebbb2bcda9f"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3551875117ccf3984c27a02b4864f4cd1c57e8ac94e5723b572e4ebbb2bcda9f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d2c73e6df73ec2c6b7e8bcee8aeaa086e6784eb2f32fcdd5956c8c7a26a9f91f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:13:14Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:13:14Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d2c73e6df73ec2c6b7e8bcee8aeaa086e6784eb2f32fcdd5956c8c7a26a9f91f"}
{"level":"info","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d2c73e6df73ec2c6b7e8bcee8aeaa086e6784eb2f32fcdd5956c8c7a26a9f91f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3551875117ccf3984c27a02b4864f4cd1c57e8ac94e5723b572e4ebbb2bcda9f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:13:14Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:13:14Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3551875117ccf3984c27a02b4864f4cd1c57e8ac94e5723b572e4ebbb2bcda9f"}
{"level":"info","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3551875117ccf3984c27a02b4864f4cd1c57e8ac94e5723b572e4ebbb2bcda9f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d2c73e6df73ec2c6b7e8bcee8aeaa086e6784eb2f32fcdd5956c8c7a26a9f91f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3551875117ccf3984c27a02b4864f4cd1c57e8ac94e5723b572e4ebbb2bcda9f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:13:14Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:13:14Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3551875117ccf3984c27a02b4864f4cd1c57e8ac94e5723b572e4ebbb2bcda9f"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3551875117ccf3984c27a02b4864f4cd1c57e8ac94e5723b572e4ebbb2bcda9f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d2c73e6df73ec2c6b7e8bcee8aeaa086e6784eb2f32fcdd5956c8c7a26a9f91f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3551875117ccf3984c27a02b4864f4cd1c57e8ac94e5723b572e4ebbb2bcda9f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:13:14Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:13:14Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3551875117ccf3984c27a02b4864f4cd1c57e8ac94e5723b572e4ebbb2bcda9f"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d2c73e6df73ec2c6b7e8bcee8aeaa086e6784eb2f32fcdd5956c8c7a26a9f91f"}
{"level":"error","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"3551875117ccf3984c27a02b4864f4cd1c57e8ac94e5723b572e4ebbb2bcda9f","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"3551875117ccf3984c27a02b4864f4cd1c57e8ac94e5723b572e4ebbb2bcda9f\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3551875117ccf3984c27a02b4864f4cd1c57e8ac94e5723b572e4ebbb2bcda9f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:13:14Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:13:14Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3551875117ccf3984c27a02b4864f4cd1c57e8ac94e5723b572e4ebbb2bcda9f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d2c73e6df73ec2c6b7e8bcee8aeaa086e6784eb2f32fcdd5956c8c7a26a9f91f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:13:14Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:13:14Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d2c73e6df73ec2c6b7e8bcee8aeaa086e6784eb2f32fcdd5956c8c7a26a9f91f"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3551875117ccf3984c27a02b4864f4cd1c57e8ac94e5723b572e4ebbb2bcda9f"}
{"level":"info","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d2c73e6df73ec2c6b7e8bcee8aeaa086e6784eb2f32fcdd5956c8c7a26a9f91f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3551875117ccf3984c27a02b4864f4cd1c57e8ac94e5723b572e4ebbb2bcda9f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d2c73e6df73ec2c6b7e8bcee8aeaa086e6784eb2f32fcdd5956c8c7a26a9f91f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3551875117ccf3984c27a02b4864f4cd1c57e8ac94e5723b572e4ebbb2bcda9f"}
{"level":"debug","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3551875117ccf3984c27a02b4864f4cd1c57e8ac94e5723b572e4ebbb2bcda9f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:13:14Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:13:14Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3551875117ccf3984c27a02b4864f4cd1c57e8ac94e5723b572e4ebbb2bcda9f"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d2c73e6df73ec2c6b7e8bcee8aeaa086e6784eb2f32fcdd5956c8c7a26a9f91f"}
{"level":"info","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3551875117ccf3984c27a02b4864f4cd1c57e8ac94e5723b572e4ebbb2bcda9f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3551875117ccf3984c27a02b4864f4cd1c57e8ac94e5723b572e4ebbb2bcda9f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:13:14Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:13:14Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3551875117ccf3984c27a02b4864f4cd1c57e8ac94e5723b572e4ebbb2bcda9f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8faf4c28b604919a04688c9d0b71f043cb8e28cc00b2ed987389e5b81eb3b7b5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:13:14Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:13:14Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3551875117ccf3984c27a02b4864f4cd1c57e8ac94e5723b572e4ebbb2bcda9f"}
{"level":"info","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8faf4c28b604919a04688c9d0b71f043cb8e28cc00b2ed987389e5b81eb3b7b5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3551875117ccf3984c27a02b4864f4cd1c57e8ac94e5723b572e4ebbb2bcda9f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:13:14Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:13:14Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3551875117ccf3984c27a02b4864f4cd1c57e8ac94e5723b572e4ebbb2bcda9f"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8faf4c28b604919a04688c9d0b71f043cb8e28cc00b2ed987389e5b81eb3b7b5"}
{"level":"info","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3551875117ccf3984c27a02b4864f4cd1c57e8ac94e5723b572e4ebbb2bcda9f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9022bf871584c1ee8e545b8083a1b2050a98b04db4f75e1d571054cf14324e3f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:13:14Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:13:14Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3551875117ccf3984c27a02b4864f4cd1c57e8ac94e5723b572e4ebbb2bcda9f"}
{"level":"info","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9022bf871584c1ee8e545b8083a1b2050a98b04db4f75e1d571054cf14324e3f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8faf4c28b604919a04688c9d0b71f043cb8e28cc00b2ed987389e5b81eb3b7b5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:13:14Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:13:14Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8faf4c28b604919a04688c9d0b71f043cb8e28cc00b2ed987389e5b81eb3b7b5"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8faf4c28b604919a04688c9d0b71f043cb8e28cc00b2ed987389e5b81eb3b7b5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3551875117ccf3984c27a02b4864f4cd1c57e8ac94e5723b572e4ebbb2bcda9f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9022bf871584c1ee8e545b8083a1b2050a98b04db4f75e1d571054cf14324e3f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:13:14Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:13:14Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9022bf871584c1ee8e545b8083a1b2050a98b04db4f75e1d571054cf14324e3f"}
{"level":"info","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9022bf871584c1ee8e545b8083a1b2050a98b04db4f75e1d571054cf14324e3f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8faf4c28b604919a04688c9d0b71f043cb8e28cc00b2ed987389e5b81eb3b7b5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:13:14Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:13:14Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8faf4c28b604919a04688c9d0b71f043cb8e28cc00b2ed987389e5b81eb3b7b5"}
{"level":"info","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8faf4c28b604919a04688c9d0b71f043cb8e28cc00b2ed987389e5b81eb3b7b5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9022bf871584c1ee8e545b8083a1b2050a98b04db4f75e1d571054cf14324e3f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:13:14Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:13:14Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9022bf871584c1ee8e545b8083a1b2050a98b04db4f75e1d571054cf14324e3f"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3551875117ccf3984c27a02b4864f4cd1c57e8ac94e5723b572e4ebbb2bcda9f"}
{"level":"info","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9022bf871584c1ee8e545b8083a1b2050a98b04db4f75e1d571054cf14324e3f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8faf4c28b604919a04688c9d0b71f043cb8e28cc00b2ed987389e5b81eb3b7b5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:13:14Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:13:14Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8faf4c28b604919a04688c9d0b71f043cb8e28cc00b2ed987389e5b81eb3b7b5"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8faf4c28b604919a04688c9d0b71f043cb8e28cc00b2ed987389e5b81eb3b7b5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ccfc7249f981cee0416a0e386cba8cdba0b3cf266e9e99878df6be42ce87f9d8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:13:14Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:13:14Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9022bf871584c1ee8e545b8083a1b2050a98b04db4f75e1d571054cf14324e3f"}
{"level":"info","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ccfc7249f981cee0416a0e386cba8cdba0b3cf266e9e99878df6be42ce87f9d8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9022bf871584c1ee8e545b8083a1b2050a98b04db4f75e1d571054cf14324e3f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8faf4c28b604919a04688c9d0b71f043cb8e28cc00b2ed987389e5b81eb3b7b5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:13:14Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:13:14Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8faf4c28b604919a04688c9d0b71f043cb8e28cc00b2ed987389e5b81eb3b7b5"}
{"level":"info","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8faf4c28b604919a04688c9d0b71f043cb8e28cc00b2ed987389e5b81eb3b7b5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ccfc7249f981cee0416a0e386cba8cdba0b3cf266e9e99878df6be42ce87f9d8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:13:14Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:13:14Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ccfc7249f981cee0416a0e386cba8cdba0b3cf266e9e99878df6be42ce87f9d8"}
{"level":"info","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ccfc7249f981cee0416a0e386cba8cdba0b3cf266e9e99878df6be42ce87f9d8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8faf4c28b604919a04688c9d0b71f043cb8e28cc00b2ed987389e5b81eb3b7b5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:13:14Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:13:14Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8faf4c28b604919a04688c9d0b71f043cb8e28cc00b2ed987389e5b81eb3b7b5"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8faf4c28b604919a04688c9d0b71f043cb8e28cc00b2ed987389e5b81eb3b7b5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ccfc7249f981cee0416a0e386cba8cdba0b3cf266e9e99878df6be42ce87f9d8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:13:14Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:13:14Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ccfc7249f981cee0416a0e386cba8cdba0b3cf266e9e99878df6be42ce87f9d8"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9022bf871584c1ee8e545b8083a1b2050a98b04db4f75e1d571054cf14324e3f"}
{"level":"info","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ccfc7249f981cee0416a0e386cba8cdba0b3cf266e9e99878df6be42ce87f9d8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8faf4c28b604919a04688c9d0b71f043cb8e28cc00b2ed987389e5b81eb3b7b5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:13:14Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:13:14Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8faf4c28b604919a04688c9d0b71f043cb8e28cc00b2ed987389e5b81eb3b7b5"}
{"level":"info","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8faf4c28b604919a04688c9d0b71f043cb8e28cc00b2ed987389e5b81eb3b7b5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"02872928c34520c992744c56cd2a8decc2c72faa0371a3cf66a4596769899cd6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:13:14Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:13:14Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ccfc7249f981cee0416a0e386cba8cdba0b3cf266e9e99878df6be42ce87f9d8"}
{"level":"info","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"02872928c34520c992744c56cd2a8decc2c72faa0371a3cf66a4596769899cd6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ccfc7249f981cee0416a0e386cba8cdba0b3cf266e9e99878df6be42ce87f9d8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4497f2636ed35517f7996014ddb76e47743246fa17c97278f7a75525a38f8f32","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:13:14Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:13:14Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/02872928c34520c992744c56cd2a8decc2c72faa0371a3cf66a4596769899cd6"}
{"level":"info","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4497f2636ed35517f7996014ddb76e47743246fa17c97278f7a75525a38f8f32","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8faf4c28b604919a04688c9d0b71f043cb8e28cc00b2ed987389e5b81eb3b7b5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:13:14Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:13:14Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8faf4c28b604919a04688c9d0b71f043cb8e28cc00b2ed987389e5b81eb3b7b5"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4497f2636ed35517f7996014ddb76e47743246fa17c97278f7a75525a38f8f32"}
{"level":"info","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8faf4c28b604919a04688c9d0b71f043cb8e28cc00b2ed987389e5b81eb3b7b5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"02872928c34520c992744c56cd2a8decc2c72faa0371a3cf66a4596769899cd6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:13:14Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:13:14Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["02872928c34520c992744c56cd2a8decc2c72faa0371a3cf66a4596769899cd6"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8faf4c28b604919a04688c9d0b71f043cb8e28cc00b2ed987389e5b81eb3b7b5"}
{"level":"info","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"02872928c34520c992744c56cd2a8decc2c72faa0371a3cf66a4596769899cd6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4497f2636ed35517f7996014ddb76e47743246fa17c97278f7a75525a38f8f32","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:13:14Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:13:14Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4497f2636ed35517f7996014ddb76e47743246fa17c97278f7a75525a38f8f32"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/02872928c34520c992744c56cd2a8decc2c72faa0371a3cf66a4596769899cd6"}
{"level":"info","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4497f2636ed35517f7996014ddb76e47743246fa17c97278f7a75525a38f8f32","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8faf4c28b604919a04688c9d0b71f043cb8e28cc00b2ed987389e5b81eb3b7b5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"64782d5b5dc52a650fc17c002109a570a7536b812428118134f5d7689a628373","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:13:14Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:13:14Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4497f2636ed35517f7996014ddb76e47743246fa17c97278f7a75525a38f8f32"}
{"level":"info","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"64782d5b5dc52a650fc17c002109a570a7536b812428118134f5d7689a628373","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"02872928c34520c992744c56cd2a8decc2c72faa0371a3cf66a4596769899cd6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4497f2636ed35517f7996014ddb76e47743246fa17c97278f7a75525a38f8f32","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"64782d5b5dc52a650fc17c002109a570a7536b812428118134f5d7689a628373","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:13:14Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:13:14Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/64782d5b5dc52a650fc17c002109a570a7536b812428118134f5d7689a628373"}
{"level":"info","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"64782d5b5dc52a650fc17c002109a570a7536b812428118134f5d7689a628373","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"64782d5b5dc52a650fc17c002109a570a7536b812428118134f5d7689a628373","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:13:14Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:13:14Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["64782d5b5dc52a650fc17c002109a570a7536b812428118134f5d7689a628373"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"64782d5b5dc52a650fc17c002109a570a7536b812428118134f5d7689a628373","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"64782d5b5dc52a650fc17c002109a570a7536b812428118134f5d7689a628373\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"64782d5b5dc52a650fc17c002109a570a7536b812428118134f5d7689a628373","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:13:14Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:13:14Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["64782d5b5dc52a650fc17c002109a570a7536b812428118134f5d7689a628373"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8faf4c28b604919a04688c9d0b71f043cb8e28cc00b2ed987389e5b81eb3b7b5"}
{"level":"info","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1c22386d7a88996965a2fe2a3b6c21237f9567e5526396d024ba3786aafe6b9f"}
{"level":"info","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"64782d5b5dc52a650fc17c002109a570a7536b812428118134f5d7689a628373","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"64782d5b5dc52a650fc17c002109a570a7536b812428118134f5d7689a628373","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:13:14Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:13:14Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["64782d5b5dc52a650fc17c002109a570a7536b812428118134f5d7689a628373"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"64782d5b5dc52a650fc17c002109a570a7536b812428118134f5d7689a628373","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"64782d5b5dc52a650fc17c002109a570a7536b812428118134f5d7689a628373\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"64782d5b5dc52a650fc17c002109a570a7536b812428118134f5d7689a628373","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/02872928c34520c992744c56cd2a8decc2c72faa0371a3cf66a4596769899cd6"}
{"level":"info","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/8769041950444089e8e236502ddb0dc67357a96fee3199cfc9770eb49cdf8d8a"}
{"level":"debug","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"64782d5b5dc52a650fc17c002109a570a7536b812428118134f5d7689a628373","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4497f2636ed35517f7996014ddb76e47743246fa17c97278f7a75525a38f8f32"}
{"level":"info","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f64647ce051a7330f99fefec1c3f76a918776ea681a2aea475dbf953ef700840"}
{"level":"info","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/64782d5b5dc52a650fc17c002109a570a7536b812428118134f5d7689a628373"}
{"level":"info","ts":"2026-07-09T18:13:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ad720c037b2c267a80e7d606d4a15e99b511408406fad284e586d10c8d04afbb"}
{"level":"info","ts":"2026-07-09T18:13:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/64b93b6206c99cbcd672a1a996cf76d848800c7648b57bbb11d6f2e590f078b6"}
{"level":"info","ts":"2026-07-09T18:13:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/866365b517230ea961a3d6f3740db5f55c33a9de2227f68a2a72be61a0d3827a"}
{"level":"info","ts":"2026-07-09T18:13:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3d3fdd54ab27fbb20386fddf8f228d46ff28bc28ce5b3e174227e7c701839bff"}
{"level":"info","ts":"2026-07-09T18:13:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/553875db3815210b31a2b9cbd05f78726f1df4c7e67b92603ab0923dbceaa720"}
{"level":"info","ts":"2026-07-09T18:13:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/0e71da54a3522462a23874baccf5bdded27cc985fcd114869a8a943890f84b6a"}
{"level":"info","ts":"2026-07-09T18:13:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/fb4e550f37dba2ea991739d1c620608c004f67ff25fd7c1b3579ae7b8447f4b6"}
{"level":"info","ts":"2026-07-09T18:13:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a9654cb6027e4278b1c6f8ee10580366de223cb20b25d8844184d6989a75fc81"}
{"level":"info","ts":"2026-07-09T18:13:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/02eaa43f5a2e2680e3123f4f54d112cacb1c868e28aedc7217e87d2b21a5701f"}
{"level":"info","ts":"2026-07-09T18:13:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/630443086a8fe9129fe13572df10ed4db5acb8b00e255b5e462267f7d8133de8"}
{"level":"info","ts":"2026-07-09T18:13:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/350f30307fa8a522d626be3aadaa02be810be0a3d2401c3ac213850d0e198baf"}
{"level":"info","ts":"2026-07-09T18:13:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/32492ba5e2ed30b35c1f4021a3bae59a250c5b47879a3c708ce6518c7d0ff6e0"}
{"level":"info","ts":"2026-07-09T18:13:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/05a24a615559c5b6eef4df23ca30ca5c56c8d22d7ce704871ed3968ae23d60c9"}
{"level":"debug","ts":"2026-07-09T18:14:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7fbac276220634445d8f6817b6d43203fb85387d7cb81c1c8e2d907b2dfcaaac","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:14:06Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:14:06Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:14:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7fbac276220634445d8f6817b6d43203fb85387d7cb81c1c8e2d907b2dfcaaac","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:14:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7fbac276220634445d8f6817b6d43203fb85387d7cb81c1c8e2d907b2dfcaaac","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:14:06Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:14:06Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:14:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7fbac276220634445d8f6817b6d43203fb85387d7cb81c1c8e2d907b2dfcaaac","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:14:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7fbac276220634445d8f6817b6d43203fb85387d7cb81c1c8e2d907b2dfcaaac","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:14:06Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:14:06Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-09T18:14:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"7fbac276220634445d8f6817b6d43203fb85387d7cb81c1c8e2d907b2dfcaaac","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"7fbac276220634445d8f6817b6d43203fb85387d7cb81c1c8e2d907b2dfcaaac\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"info","ts":"2026-07-09T18:14:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7fbac276220634445d8f6817b6d43203fb85387d7cb81c1c8e2d907b2dfcaaac"}
{"level":"debug","ts":"2026-07-09T18:14:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7fbac276220634445d8f6817b6d43203fb85387d7cb81c1c8e2d907b2dfcaaac","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:14:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7fbac276220634445d8f6817b6d43203fb85387d7cb81c1c8e2d907b2dfcaaac","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:14:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7fbac276220634445d8f6817b6d43203fb85387d7cb81c1c8e2d907b2dfcaaac"}
{"level":"debug","ts":"2026-07-09T18:14:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7fbac276220634445d8f6817b6d43203fb85387d7cb81c1c8e2d907b2dfcaaac","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:14:06Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:14:06Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7fbac276220634445d8f6817b6d43203fb85387d7cb81c1c8e2d907b2dfcaaac"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:14:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7fbac276220634445d8f6817b6d43203fb85387d7cb81c1c8e2d907b2dfcaaac","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:14:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7fbac276220634445d8f6817b6d43203fb85387d7cb81c1c8e2d907b2dfcaaac","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:14:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7fbac276220634445d8f6817b6d43203fb85387d7cb81c1c8e2d907b2dfcaaac"}
{"level":"debug","ts":"2026-07-09T18:14:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"328ac1cd7fa902c7251c9136cce18d5edaf6548fd739c05b51324ea9c56c169e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:14:06Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:14:06Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:14:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"328ac1cd7fa902c7251c9136cce18d5edaf6548fd739c05b51324ea9c56c169e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:14:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"328ac1cd7fa902c7251c9136cce18d5edaf6548fd739c05b51324ea9c56c169e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:14:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"328ac1cd7fa902c7251c9136cce18d5edaf6548fd739c05b51324ea9c56c169e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:14:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/328ac1cd7fa902c7251c9136cce18d5edaf6548fd739c05b51324ea9c56c169e"}
{"level":"debug","ts":"2026-07-09T18:14:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"328ac1cd7fa902c7251c9136cce18d5edaf6548fd739c05b51324ea9c56c169e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:14:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/328ac1cd7fa902c7251c9136cce18d5edaf6548fd739c05b51324ea9c56c169e"}
{"level":"debug","ts":"2026-07-09T18:14:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"328ac1cd7fa902c7251c9136cce18d5edaf6548fd739c05b51324ea9c56c169e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:14:06Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:14:06Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["328ac1cd7fa902c7251c9136cce18d5edaf6548fd739c05b51324ea9c56c169e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:14:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"328ac1cd7fa902c7251c9136cce18d5edaf6548fd739c05b51324ea9c56c169e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:14:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3455d8f8a1e11fba85909b8231717c92033ad1c6a916ad9ced0ad92b6291b67c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:14:06Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:14:06Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:14:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3455d8f8a1e11fba85909b8231717c92033ad1c6a916ad9ced0ad92b6291b67c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:14:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"328ac1cd7fa902c7251c9136cce18d5edaf6548fd739c05b51324ea9c56c169e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:14:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3455d8f8a1e11fba85909b8231717c92033ad1c6a916ad9ced0ad92b6291b67c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:14:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3455d8f8a1e11fba85909b8231717c92033ad1c6a916ad9ced0ad92b6291b67c"}
{"level":"debug","ts":"2026-07-09T18:14:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3455d8f8a1e11fba85909b8231717c92033ad1c6a916ad9ced0ad92b6291b67c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:14:06Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:14:06Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3455d8f8a1e11fba85909b8231717c92033ad1c6a916ad9ced0ad92b6291b67c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:14:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3455d8f8a1e11fba85909b8231717c92033ad1c6a916ad9ced0ad92b6291b67c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:14:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3455d8f8a1e11fba85909b8231717c92033ad1c6a916ad9ced0ad92b6291b67c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:14:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/328ac1cd7fa902c7251c9136cce18d5edaf6548fd739c05b51324ea9c56c169e"}
{"level":"info","ts":"2026-07-09T18:14:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3455d8f8a1e11fba85909b8231717c92033ad1c6a916ad9ced0ad92b6291b67c"}
{"level":"debug","ts":"2026-07-09T18:14:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"52207e8808a5af400ac23bdc55d7ab4dfa8777350b1e22159ca72575a356c947","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:14:06Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:14:06Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:14:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"52207e8808a5af400ac23bdc55d7ab4dfa8777350b1e22159ca72575a356c947","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:14:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"52207e8808a5af400ac23bdc55d7ab4dfa8777350b1e22159ca72575a356c947","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:14:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"52207e8808a5af400ac23bdc55d7ab4dfa8777350b1e22159ca72575a356c947","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:14:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/52207e8808a5af400ac23bdc55d7ab4dfa8777350b1e22159ca72575a356c947"}
{"level":"debug","ts":"2026-07-09T18:14:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"52207e8808a5af400ac23bdc55d7ab4dfa8777350b1e22159ca72575a356c947","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:14:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/52207e8808a5af400ac23bdc55d7ab4dfa8777350b1e22159ca72575a356c947"}
{"level":"debug","ts":"2026-07-09T18:14:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"52207e8808a5af400ac23bdc55d7ab4dfa8777350b1e22159ca72575a356c947","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:14:06Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:14:06Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["52207e8808a5af400ac23bdc55d7ab4dfa8777350b1e22159ca72575a356c947"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:14:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"52207e8808a5af400ac23bdc55d7ab4dfa8777350b1e22159ca72575a356c947","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:14:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"858e15e1a7184d729f8a1f69fcfd3b082b5fa0a39b96378ef7ff02e147dfce8c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:14:06Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:14:06Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:14:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"858e15e1a7184d729f8a1f69fcfd3b082b5fa0a39b96378ef7ff02e147dfce8c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:14:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"52207e8808a5af400ac23bdc55d7ab4dfa8777350b1e22159ca72575a356c947","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:14:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"612e4d6571f54392dc4bb1845f7d87f335994587f999a2d7f8cd344aeaf1d36f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:14:06Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:14:06Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:14:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/858e15e1a7184d729f8a1f69fcfd3b082b5fa0a39b96378ef7ff02e147dfce8c"}
{"level":"info","ts":"2026-07-09T18:14:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"612e4d6571f54392dc4bb1845f7d87f335994587f999a2d7f8cd344aeaf1d36f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:14:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"858e15e1a7184d729f8a1f69fcfd3b082b5fa0a39b96378ef7ff02e147dfce8c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:14:06Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:14:06Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["858e15e1a7184d729f8a1f69fcfd3b082b5fa0a39b96378ef7ff02e147dfce8c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:14:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/52207e8808a5af400ac23bdc55d7ab4dfa8777350b1e22159ca72575a356c947"}
{"level":"info","ts":"2026-07-09T18:14:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"858e15e1a7184d729f8a1f69fcfd3b082b5fa0a39b96378ef7ff02e147dfce8c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:14:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"612e4d6571f54392dc4bb1845f7d87f335994587f999a2d7f8cd344aeaf1d36f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:14:06Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:14:06Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:14:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"612e4d6571f54392dc4bb1845f7d87f335994587f999a2d7f8cd344aeaf1d36f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:14:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"858e15e1a7184d729f8a1f69fcfd3b082b5fa0a39b96378ef7ff02e147dfce8c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:14:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"612e4d6571f54392dc4bb1845f7d87f335994587f999a2d7f8cd344aeaf1d36f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:14:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/612e4d6571f54392dc4bb1845f7d87f335994587f999a2d7f8cd344aeaf1d36f"}
{"level":"debug","ts":"2026-07-09T18:14:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"612e4d6571f54392dc4bb1845f7d87f335994587f999a2d7f8cd344aeaf1d36f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:14:06Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:14:06Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["612e4d6571f54392dc4bb1845f7d87f335994587f999a2d7f8cd344aeaf1d36f"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:14:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"612e4d6571f54392dc4bb1845f7d87f335994587f999a2d7f8cd344aeaf1d36f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:14:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"612e4d6571f54392dc4bb1845f7d87f335994587f999a2d7f8cd344aeaf1d36f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:14:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/858e15e1a7184d729f8a1f69fcfd3b082b5fa0a39b96378ef7ff02e147dfce8c"}
{"level":"info","ts":"2026-07-09T18:14:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/612e4d6571f54392dc4bb1845f7d87f335994587f999a2d7f8cd344aeaf1d36f"}
{"level":"debug","ts":"2026-07-09T18:14:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ddff7ede1f151ef30e3f545ea4b684ed64ab790bace80fb118471e204787c69c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:14:06Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:14:06Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:14:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ddff7ede1f151ef30e3f545ea4b684ed64ab790bace80fb118471e204787c69c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:14:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ddff7ede1f151ef30e3f545ea4b684ed64ab790bace80fb118471e204787c69c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:14:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ddff7ede1f151ef30e3f545ea4b684ed64ab790bace80fb118471e204787c69c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:14:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ddff7ede1f151ef30e3f545ea4b684ed64ab790bace80fb118471e204787c69c"}
{"level":"debug","ts":"2026-07-09T18:14:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ddff7ede1f151ef30e3f545ea4b684ed64ab790bace80fb118471e204787c69c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:14:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ddff7ede1f151ef30e3f545ea4b684ed64ab790bace80fb118471e204787c69c"}
{"level":"debug","ts":"2026-07-09T18:14:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ddff7ede1f151ef30e3f545ea4b684ed64ab790bace80fb118471e204787c69c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:14:07Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:14:07Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ddff7ede1f151ef30e3f545ea4b684ed64ab790bace80fb118471e204787c69c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:14:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ddff7ede1f151ef30e3f545ea4b684ed64ab790bace80fb118471e204787c69c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:14:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ddff7ede1f151ef30e3f545ea4b684ed64ab790bace80fb118471e204787c69c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:14:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ee6545a443da010e397446e5aea8407d7494c0bf8df9dfd263e5d11d03b99e7e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:14:07Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:14:07Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:14:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ddff7ede1f151ef30e3f545ea4b684ed64ab790bace80fb118471e204787c69c"}
{"level":"info","ts":"2026-07-09T18:14:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ee6545a443da010e397446e5aea8407d7494c0bf8df9dfd263e5d11d03b99e7e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:14:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ee6545a443da010e397446e5aea8407d7494c0bf8df9dfd263e5d11d03b99e7e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:14:07Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:14:07Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:14:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ee6545a443da010e397446e5aea8407d7494c0bf8df9dfd263e5d11d03b99e7e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:14:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ee6545a443da010e397446e5aea8407d7494c0bf8df9dfd263e5d11d03b99e7e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:14:07Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:14:07Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:14:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ee6545a443da010e397446e5aea8407d7494c0bf8df9dfd263e5d11d03b99e7e"}
{"level":"error","ts":"2026-07-09T18:14:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"ee6545a443da010e397446e5aea8407d7494c0bf8df9dfd263e5d11d03b99e7e","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"ee6545a443da010e397446e5aea8407d7494c0bf8df9dfd263e5d11d03b99e7e\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-09T18:14:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ee6545a443da010e397446e5aea8407d7494c0bf8df9dfd263e5d11d03b99e7e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:14:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ee6545a443da010e397446e5aea8407d7494c0bf8df9dfd263e5d11d03b99e7e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:14:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ee6545a443da010e397446e5aea8407d7494c0bf8df9dfd263e5d11d03b99e7e"}
{"level":"debug","ts":"2026-07-09T18:14:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ee6545a443da010e397446e5aea8407d7494c0bf8df9dfd263e5d11d03b99e7e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:14:07Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:14:07Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ee6545a443da010e397446e5aea8407d7494c0bf8df9dfd263e5d11d03b99e7e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:14:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ee6545a443da010e397446e5aea8407d7494c0bf8df9dfd263e5d11d03b99e7e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:14:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ee6545a443da010e397446e5aea8407d7494c0bf8df9dfd263e5d11d03b99e7e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:14:07Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:14:07Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:14:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ee6545a443da010e397446e5aea8407d7494c0bf8df9dfd263e5d11d03b99e7e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:14:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ee6545a443da010e397446e5aea8407d7494c0bf8df9dfd263e5d11d03b99e7e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:14:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ee6545a443da010e397446e5aea8407d7494c0bf8df9dfd263e5d11d03b99e7e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:14:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ee6545a443da010e397446e5aea8407d7494c0bf8df9dfd263e5d11d03b99e7e"}
{"level":"debug","ts":"2026-07-09T18:14:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ee6545a443da010e397446e5aea8407d7494c0bf8df9dfd263e5d11d03b99e7e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:14:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ee6545a443da010e397446e5aea8407d7494c0bf8df9dfd263e5d11d03b99e7e"}
{"level":"debug","ts":"2026-07-09T18:14:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ee6545a443da010e397446e5aea8407d7494c0bf8df9dfd263e5d11d03b99e7e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:14:07Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:14:07Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ee6545a443da010e397446e5aea8407d7494c0bf8df9dfd263e5d11d03b99e7e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:14:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ee6545a443da010e397446e5aea8407d7494c0bf8df9dfd263e5d11d03b99e7e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:14:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ee6545a443da010e397446e5aea8407d7494c0bf8df9dfd263e5d11d03b99e7e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:14:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ee6545a443da010e397446e5aea8407d7494c0bf8df9dfd263e5d11d03b99e7e"}
{"level":"debug","ts":"2026-07-09T18:14:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ccfc7249f981cee0416a0e386cba8cdba0b3cf266e9e99878df6be42ce87f9d8","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:14:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ccfc7249f981cee0416a0e386cba8cdba0b3cf266e9e99878df6be42ce87f9d8"}
{"level":"debug","ts":"2026-07-09T18:14:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"52207e8808a5af400ac23bdc55d7ab4dfa8777350b1e22159ca72575a356c947","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:14:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/52207e8808a5af400ac23bdc55d7ab4dfa8777350b1e22159ca72575a356c947"}
{"level":"debug","ts":"2026-07-09T18:14:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d0dc982a4b2bb71b26b48cdc76131f83b5c5ef6691a5682c984d9c772913a6de","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:14:18Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:14:18Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:14:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d0dc982a4b2bb71b26b48cdc76131f83b5c5ef6691a5682c984d9c772913a6de","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:14:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d0dc982a4b2bb71b26b48cdc76131f83b5c5ef6691a5682c984d9c772913a6de","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:14:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d0dc982a4b2bb71b26b48cdc76131f83b5c5ef6691a5682c984d9c772913a6de"}
{"level":"debug","ts":"2026-07-09T18:14:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d0dc982a4b2bb71b26b48cdc76131f83b5c5ef6691a5682c984d9c772913a6de","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:14:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d0dc982a4b2bb71b26b48cdc76131f83b5c5ef6691a5682c984d9c772913a6de","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:14:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d0dc982a4b2bb71b26b48cdc76131f83b5c5ef6691a5682c984d9c772913a6de"}
{"level":"debug","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d0dc982a4b2bb71b26b48cdc76131f83b5c5ef6691a5682c984d9c772913a6de","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:14:19Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:14:19Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d0dc982a4b2bb71b26b48cdc76131f83b5c5ef6691a5682c984d9c772913a6de"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d0dc982a4b2bb71b26b48cdc76131f83b5c5ef6691a5682c984d9c772913a6de","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d0dc982a4b2bb71b26b48cdc76131f83b5c5ef6691a5682c984d9c772913a6de","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:14:19Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:14:19Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d0dc982a4b2bb71b26b48cdc76131f83b5c5ef6691a5682c984d9c772913a6de","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"328ac1cd7fa902c7251c9136cce18d5edaf6548fd739c05b51324ea9c56c169e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d0dc982a4b2bb71b26b48cdc76131f83b5c5ef6691a5682c984d9c772913a6de","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d0dc982a4b2bb71b26b48cdc76131f83b5c5ef6691a5682c984d9c772913a6de","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d0dc982a4b2bb71b26b48cdc76131f83b5c5ef6691a5682c984d9c772913a6de"}
{"level":"debug","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d0dc982a4b2bb71b26b48cdc76131f83b5c5ef6691a5682c984d9c772913a6de","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:14:19Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:14:19Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d0dc982a4b2bb71b26b48cdc76131f83b5c5ef6691a5682c984d9c772913a6de"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/328ac1cd7fa902c7251c9136cce18d5edaf6548fd739c05b51324ea9c56c169e"}
{"level":"info","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d0dc982a4b2bb71b26b48cdc76131f83b5c5ef6691a5682c984d9c772913a6de","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d0dc982a4b2bb71b26b48cdc76131f83b5c5ef6691a5682c984d9c772913a6de","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:14:19Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:14:19Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d0dc982a4b2bb71b26b48cdc76131f83b5c5ef6691a5682c984d9c772913a6de"}
{"level":"info","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d0dc982a4b2bb71b26b48cdc76131f83b5c5ef6691a5682c984d9c772913a6de","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d0dc982a4b2bb71b26b48cdc76131f83b5c5ef6691a5682c984d9c772913a6de","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d0dc982a4b2bb71b26b48cdc76131f83b5c5ef6691a5682c984d9c772913a6de","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d0dc982a4b2bb71b26b48cdc76131f83b5c5ef6691a5682c984d9c772913a6de"}
{"level":"debug","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d0dc982a4b2bb71b26b48cdc76131f83b5c5ef6691a5682c984d9c772913a6de","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ee6545a443da010e397446e5aea8407d7494c0bf8df9dfd263e5d11d03b99e7e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d0dc982a4b2bb71b26b48cdc76131f83b5c5ef6691a5682c984d9c772913a6de"}
{"level":"info","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ee6545a443da010e397446e5aea8407d7494c0bf8df9dfd263e5d11d03b99e7e"}
{"level":"debug","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d0dc982a4b2bb71b26b48cdc76131f83b5c5ef6691a5682c984d9c772913a6de","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:14:19Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:14:19Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d0dc982a4b2bb71b26b48cdc76131f83b5c5ef6691a5682c984d9c772913a6de"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d0dc982a4b2bb71b26b48cdc76131f83b5c5ef6691a5682c984d9c772913a6de","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d0dc982a4b2bb71b26b48cdc76131f83b5c5ef6691a5682c984d9c772913a6de","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:14:19Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:14:19Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d0dc982a4b2bb71b26b48cdc76131f83b5c5ef6691a5682c984d9c772913a6de","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d0dc982a4b2bb71b26b48cdc76131f83b5c5ef6691a5682c984d9c772913a6de","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d0dc982a4b2bb71b26b48cdc76131f83b5c5ef6691a5682c984d9c772913a6de","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d0dc982a4b2bb71b26b48cdc76131f83b5c5ef6691a5682c984d9c772913a6de"}
{"level":"debug","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d0dc982a4b2bb71b26b48cdc76131f83b5c5ef6691a5682c984d9c772913a6de","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d0dc982a4b2bb71b26b48cdc76131f83b5c5ef6691a5682c984d9c772913a6de"}
{"level":"debug","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"64782d5b5dc52a650fc17c002109a570a7536b812428118134f5d7689a628373","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:14:19Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:14:19Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/64782d5b5dc52a650fc17c002109a570a7536b812428118134f5d7689a628373"}
{"level":"info","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"64782d5b5dc52a650fc17c002109a570a7536b812428118134f5d7689a628373","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"64782d5b5dc52a650fc17c002109a570a7536b812428118134f5d7689a628373","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:14:19Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:14:19Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["64782d5b5dc52a650fc17c002109a570a7536b812428118134f5d7689a628373"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"64782d5b5dc52a650fc17c002109a570a7536b812428118134f5d7689a628373","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d0dc982a4b2bb71b26b48cdc76131f83b5c5ef6691a5682c984d9c772913a6de","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:14:19Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:14:19Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d0dc982a4b2bb71b26b48cdc76131f83b5c5ef6691a5682c984d9c772913a6de"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/64782d5b5dc52a650fc17c002109a570a7536b812428118134f5d7689a628373"}
{"level":"info","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d0dc982a4b2bb71b26b48cdc76131f83b5c5ef6691a5682c984d9c772913a6de","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"64782d5b5dc52a650fc17c002109a570a7536b812428118134f5d7689a628373","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:14:19Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:14:19Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/64782d5b5dc52a650fc17c002109a570a7536b812428118134f5d7689a628373"}
{"level":"info","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"64782d5b5dc52a650fc17c002109a570a7536b812428118134f5d7689a628373","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d0dc982a4b2bb71b26b48cdc76131f83b5c5ef6691a5682c984d9c772913a6de","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:14:19Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:14:19Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d0dc982a4b2bb71b26b48cdc76131f83b5c5ef6691a5682c984d9c772913a6de"}
{"level":"info","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d0dc982a4b2bb71b26b48cdc76131f83b5c5ef6691a5682c984d9c772913a6de","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"64782d5b5dc52a650fc17c002109a570a7536b812428118134f5d7689a628373","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d0dc982a4b2bb71b26b48cdc76131f83b5c5ef6691a5682c984d9c772913a6de","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:14:19Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:14:19Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d0dc982a4b2bb71b26b48cdc76131f83b5c5ef6691a5682c984d9c772913a6de"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d0dc982a4b2bb71b26b48cdc76131f83b5c5ef6691a5682c984d9c772913a6de","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"64782d5b5dc52a650fc17c002109a570a7536b812428118134f5d7689a628373","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3551875117ccf3984c27a02b4864f4cd1c57e8ac94e5723b572e4ebbb2bcda9f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d0dc982a4b2bb71b26b48cdc76131f83b5c5ef6691a5682c984d9c772913a6de","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:14:19Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:14:19Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d0dc982a4b2bb71b26b48cdc76131f83b5c5ef6691a5682c984d9c772913a6de"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/64782d5b5dc52a650fc17c002109a570a7536b812428118134f5d7689a628373"}
{"level":"error","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"d0dc982a4b2bb71b26b48cdc76131f83b5c5ef6691a5682c984d9c772913a6de","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"d0dc982a4b2bb71b26b48cdc76131f83b5c5ef6691a5682c984d9c772913a6de\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d0dc982a4b2bb71b26b48cdc76131f83b5c5ef6691a5682c984d9c772913a6de","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:14:19Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:14:19Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d0dc982a4b2bb71b26b48cdc76131f83b5c5ef6691a5682c984d9c772913a6de","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"64782d5b5dc52a650fc17c002109a570a7536b812428118134f5d7689a628373","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:14:19Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:14:19Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["64782d5b5dc52a650fc17c002109a570a7536b812428118134f5d7689a628373"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d0dc982a4b2bb71b26b48cdc76131f83b5c5ef6691a5682c984d9c772913a6de"}
{"level":"info","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"64782d5b5dc52a650fc17c002109a570a7536b812428118134f5d7689a628373","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d0dc982a4b2bb71b26b48cdc76131f83b5c5ef6691a5682c984d9c772913a6de","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:14:19Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:14:19Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d0dc982a4b2bb71b26b48cdc76131f83b5c5ef6691a5682c984d9c772913a6de"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d0dc982a4b2bb71b26b48cdc76131f83b5c5ef6691a5682c984d9c772913a6de","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"64782d5b5dc52a650fc17c002109a570a7536b812428118134f5d7689a628373","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d0dc982a4b2bb71b26b48cdc76131f83b5c5ef6691a5682c984d9c772913a6de","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3551875117ccf3984c27a02b4864f4cd1c57e8ac94e5723b572e4ebbb2bcda9f"}
{"level":"debug","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4497f2636ed35517f7996014ddb76e47743246fa17c97278f7a75525a38f8f32","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d0dc982a4b2bb71b26b48cdc76131f83b5c5ef6691a5682c984d9c772913a6de"}
{"level":"info","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/64782d5b5dc52a650fc17c002109a570a7536b812428118134f5d7689a628373"}
{"level":"info","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4497f2636ed35517f7996014ddb76e47743246fa17c97278f7a75525a38f8f32"}
{"level":"debug","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9b729fee5f198546b25447d43f6aac3c5d2da0ab25e3729b865bc3257e29673a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9b729fee5f198546b25447d43f6aac3c5d2da0ab25e3729b865bc3257e29673a"}
{"level":"debug","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"858e15e1a7184d729f8a1f69fcfd3b082b5fa0a39b96378ef7ff02e147dfce8c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:14:19Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:14:19Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"858e15e1a7184d729f8a1f69fcfd3b082b5fa0a39b96378ef7ff02e147dfce8c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"858e15e1a7184d729f8a1f69fcfd3b082b5fa0a39b96378ef7ff02e147dfce8c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7fbac276220634445d8f6817b6d43203fb85387d7cb81c1c8e2d907b2dfcaaac","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"858e15e1a7184d729f8a1f69fcfd3b082b5fa0a39b96378ef7ff02e147dfce8c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/858e15e1a7184d729f8a1f69fcfd3b082b5fa0a39b96378ef7ff02e147dfce8c"}
{"level":"debug","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d9bdad4f2209ade368fb8e3e9899aed674691a49f320a4c7056f5befc66c4d25","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"858e15e1a7184d729f8a1f69fcfd3b082b5fa0a39b96378ef7ff02e147dfce8c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:14:19Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:14:19Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["858e15e1a7184d729f8a1f69fcfd3b082b5fa0a39b96378ef7ff02e147dfce8c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7fbac276220634445d8f6817b6d43203fb85387d7cb81c1c8e2d907b2dfcaaac"}
{"level":"info","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"858e15e1a7184d729f8a1f69fcfd3b082b5fa0a39b96378ef7ff02e147dfce8c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9022bf871584c1ee8e545b8083a1b2050a98b04db4f75e1d571054cf14324e3f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"858e15e1a7184d729f8a1f69fcfd3b082b5fa0a39b96378ef7ff02e147dfce8c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T18:14:19Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T18:14:19Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/858e15e1a7184d729f8a1f69fcfd3b082b5fa0a39b96378ef7ff02e147dfce8c"}
{"level":"info","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"858e15e1a7184d729f8a1f69fcfd3b082b5fa0a39b96378ef7ff02e147dfce8c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"858e15e1a7184d729f8a1f69fcfd3b082b5fa0a39b96378ef7ff02e147dfce8c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:14:19Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:14:19Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["858e15e1a7184d729f8a1f69fcfd3b082b5fa0a39b96378ef7ff02e147dfce8c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"858e15e1a7184d729f8a1f69fcfd3b082b5fa0a39b96378ef7ff02e147dfce8c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"858e15e1a7184d729f8a1f69fcfd3b082b5fa0a39b96378ef7ff02e147dfce8c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T18:14:19Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T18:14:19Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["858e15e1a7184d729f8a1f69fcfd3b082b5fa0a39b96378ef7ff02e147dfce8c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d9bdad4f2209ade368fb8e3e9899aed674691a49f320a4c7056f5befc66c4d25"}
{"level":"error","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"858e15e1a7184d729f8a1f69fcfd3b082b5fa0a39b96378ef7ff02e147dfce8c","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"858e15e1a7184d729f8a1f69fcfd3b082b5fa0a39b96378ef7ff02e147dfce8c\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"858e15e1a7184d729f8a1f69fcfd3b082b5fa0a39b96378ef7ff02e147dfce8c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3b3177991297fdbae2c007ceba4a843cc4cee6ffb746764254c1b3c63519840e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"858e15e1a7184d729f8a1f69fcfd3b082b5fa0a39b96378ef7ff02e147dfce8c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9022bf871584c1ee8e545b8083a1b2050a98b04db4f75e1d571054cf14324e3f"}
{"level":"debug","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6fff71fcd45a294412257cdd7721672479b46bddf883bead293812798aca2799","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/858e15e1a7184d729f8a1f69fcfd3b082b5fa0a39b96378ef7ff02e147dfce8c"}
{"level":"debug","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"612e4d6571f54392dc4bb1845f7d87f335994587f999a2d7f8cd344aeaf1d36f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3455d8f8a1e11fba85909b8231717c92033ad1c6a916ad9ced0ad92b6291b67c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3b3177991297fdbae2c007ceba4a843cc4cee6ffb746764254c1b3c63519840e"}
{"level":"debug","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d8e0850808cc3464b9bc0513c8149e79e80d6d1342e3ad0fcb38a541c9d49a0d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6fff71fcd45a294412257cdd7721672479b46bddf883bead293812798aca2799"}
{"level":"info","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/612e4d6571f54392dc4bb1845f7d87f335994587f999a2d7f8cd344aeaf1d36f"}
{"level":"debug","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3682972e0c81bfc88ef826fc0824c34a3a6f73b8888ffa4426c86a341dd9b2cc","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3455d8f8a1e11fba85909b8231717c92033ad1c6a916ad9ced0ad92b6291b67c"}
{"level":"debug","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d2c73e6df73ec2c6b7e8bcee8aeaa086e6784eb2f32fcdd5956c8c7a26a9f91f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d8e0850808cc3464b9bc0513c8149e79e80d6d1342e3ad0fcb38a541c9d49a0d"}
{"level":"debug","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8faf4c28b604919a04688c9d0b71f043cb8e28cc00b2ed987389e5b81eb3b7b5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"da41b07f92d255d3238b29ad30df8c0ee8a4fe5642aa41d9956e7ed89f5cb3bc","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3682972e0c81bfc88ef826fc0824c34a3a6f73b8888ffa4426c86a341dd9b2cc"}
{"level":"debug","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ddff7ede1f151ef30e3f545ea4b684ed64ab790bace80fb118471e204787c69c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d2c73e6df73ec2c6b7e8bcee8aeaa086e6784eb2f32fcdd5956c8c7a26a9f91f"}
{"level":"debug","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"02872928c34520c992744c56cd2a8decc2c72faa0371a3cf66a4596769899cd6","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8faf4c28b604919a04688c9d0b71f043cb8e28cc00b2ed987389e5b81eb3b7b5"}
{"level":"info","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/da41b07f92d255d3238b29ad30df8c0ee8a4fe5642aa41d9956e7ed89f5cb3bc"}
{"level":"info","ts":"2026-07-09T18:14:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ddff7ede1f151ef30e3f545ea4b684ed64ab790bace80fb118471e204787c69c"}
{"level":"info","ts":"2026-07-09T18:14:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/02872928c34520c992744c56cd2a8decc2c72faa0371a3cf66a4596769899cd6"}
{"level":"info","ts":"2026-07-09T18:14:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7b02eab8-778f-43ff-b749-5f81a7242861","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:60378","PortSpecifier":{"PortValue":60378}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"7b02eab8-778f-43ff-b749-5f81a7242861","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-09d279.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T18:14:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7b02eab8-778f-43ff-b749-5f81a7242861","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:60378","PortSpecifier":{"PortValue":60378}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783620873,"nanos":216467154},"http":{"id":"7b02eab8-778f-43ff-b749-5f81a7242861","method":"POST","headers":{":authority":"e2e-shared-a-09d279.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:14:33Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"7b02eab8-778f-43ff-b749-5f81a7242861","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T18:14:33Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"7b02eab8-778f-43ff-b749-5f81a7242861","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"8a03aca8-c185-4c8a-b6bd-33878f9e863c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=d0cd2685-b2e1-4705-9a11-a82c8e44ad44"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab31c6ab9b00"]}}
{"level":"debug","ts":"2026-07-09T18:14:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"7b02eab8-778f-43ff-b749-5f81a7242861","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab31c6ab9b00"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=d0cd2685-b2e1-4705-9a11-a82c8e44ad44"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"8a03aca8-c185-4c8a-b6bd-33878f9e863c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"6fff71fcd45a294412257cdd7721672479b46bddf883bead293812798aca2799"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.47:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-09d279.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:14:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7b02eab8-778f-43ff-b749-5f81a7242861","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7b02eab8-778f-43ff-b749-5f81a7242861","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7b02eab8-778f-43ff-b749-5f81a7242861","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-09d279/rate-test-model-09d279\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"7b02eab8-778f-43ff-b749-5f81a7242861","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T18:14:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7b02eab8-778f-43ff-b749-5f81a7242861","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T18:14:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7b02eab8-778f-43ff-b749-5f81a7242861","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-09T18:14:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7b02eab8-778f-43ff-b749-5f81a7242861","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T18:14:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7b02eab8-778f-43ff-b749-5f81a7242861","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T18:14:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"703af138-26c9-47a8-a90e-1e02387d9fa6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:42678","PortSpecifier":{"PortValue":42678}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"703af138-26c9-47a8-a90e-1e02387d9fa6","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-e0b9f9.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T18:14:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"703af138-26c9-47a8-a90e-1e02387d9fa6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:42678","PortSpecifier":{"PortValue":42678}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783620873,"nanos":259671745},"http":{"id":"703af138-26c9-47a8-a90e-1e02387d9fa6","method":"POST","headers":{":authority":"e2e-shared-b-e0b9f9.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:14:33Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"703af138-26c9-47a8-a90e-1e02387d9fa6","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T18:14:33Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"703af138-26c9-47a8-a90e-1e02387d9fa6","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"8a03aca8-c185-4c8a-b6bd-33878f9e863c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=d0cd2685-b2e1-4705-9a11-a82c8e44ad44"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab31c6ab9b00"]}}
{"level":"debug","ts":"2026-07-09T18:14:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"703af138-26c9-47a8-a90e-1e02387d9fa6","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab31c6ab9b00"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=d0cd2685-b2e1-4705-9a11-a82c8e44ad44"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"8a03aca8-c185-4c8a-b6bd-33878f9e863c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"3682972e0c81bfc88ef826fc0824c34a3a6f73b8888ffa4426c86a341dd9b2cc"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.48:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-e0b9f9.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:14:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"703af138-26c9-47a8-a90e-1e02387d9fa6","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"703af138-26c9-47a8-a90e-1e02387d9fa6","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"703af138-26c9-47a8-a90e-1e02387d9fa6","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-e0b9f9/rate-test-model-e0b9f9\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"703af138-26c9-47a8-a90e-1e02387d9fa6","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T18:14:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"703af138-26c9-47a8-a90e-1e02387d9fa6","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T18:14:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"703af138-26c9-47a8-a90e-1e02387d9fa6","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T18:14:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"703af138-26c9-47a8-a90e-1e02387d9fa6","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T18:14:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"703af138-26c9-47a8-a90e-1e02387d9fa6","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T18:14:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3b05718a-355b-47be-a766-2f0102f3a9d2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:60394","PortSpecifier":{"PortValue":60394}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3b05718a-355b-47be-a766-2f0102f3a9d2","method":"POST","path":"/ai-tenant-e2e-shared-a-09d279/rate-test-model-09d279/v1/completions","host":"e2e-shared-a-09d279.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T18:14:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3b05718a-355b-47be-a766-2f0102f3a9d2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:60394","PortSpecifier":{"PortValue":60394}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783620873,"nanos":300137343},"http":{"id":"3b05718a-355b-47be-a766-2f0102f3a9d2","method":"POST","headers":{":authority":"e2e-shared-a-09d279.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-09d279/rate-test-model-09d279/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:14:33Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3b05718a-355b-47be-a766-2f0102f3a9d2","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1PxzonwpH86SUaqow_Y7CrXW6Bdl1InJA48k8tA7fH8rD7Ho4Z7Ih03NxWzq6"}
{"level":"debug","ts":"2026-07-09T18:14:33Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3b05718a-355b-47be-a766-2f0102f3a9d2","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-09d279.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1PxzonwpH86SUaqow_Y7CrXW6Bdl1InJA48k8tA7fH8rD7Ho4Z7Ih03NxWzq6\"}"}
{"level":"debug","ts":"2026-07-09T18:14:33Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3b05718a-355b-47be-a766-2f0102f3a9d2","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-09d279.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"30b23380-1b43-43ca-91d1-6f19a5186e63","keyName":"e2e-rate-a-b6ad11","subscription":"e2e-rate-iso-a-b6ad11","tenant":"e2e-shared-a-09d279","userId":"30b23380-1b43-43ca-91d1-6f19a5186e63","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T18:14:33Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3b05718a-355b-47be-a766-2f0102f3a9d2","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-09d279.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-09d279/rate-test-model-09d279\",\"requestedSubscription\":\"e2e-rate-iso-a-b6ad11\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T18:14:33Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3b05718a-355b-47be-a766-2f0102f3a9d2","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-09d279.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-09d279","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-b6ad11","namespace":"ai-tenant-e2e-shared-a-09d279","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T18:14:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3b05718a-355b-47be-a766-2f0102f3a9d2","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:14:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3b05718a-355b-47be-a766-2f0102f3a9d2","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3b05718a-355b-47be-a766-2f0102f3a9d2","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3b05718a-355b-47be-a766-2f0102f3a9d2","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-09d279/rate-test-model-09d279\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3b05718a-355b-47be-a766-2f0102f3a9d2","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3b05718a-355b-47be-a766-2f0102f3a9d2","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T18:14:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3b05718a-355b-47be-a766-2f0102f3a9d2","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T18:14:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3b05718a-355b-47be-a766-2f0102f3a9d2","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-b6ad11"}
{"level":"debug","ts":"2026-07-09T18:14:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3b05718a-355b-47be-a766-2f0102f3a9d2","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"30b23380-1b43-43ca-91d1-6f19a5186e63","keyName":"e2e-rate-a-b6ad11","selected_subscription":"e2e-rate-iso-a-b6ad11","selected_subscription_key":"ai-tenant-e2e-shared-a-09d279/e2e-rate-iso-a-b6ad11@ai-tenant-e2e-shared-a-09d279/rate-test-model-09d279","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-09d279","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-b6ad11","namespace":"ai-tenant-e2e-shared-a-09d279","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T18:14:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3b05718a-355b-47be-a766-2f0102f3a9d2","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T18:14:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3b05718a-355b-47be-a766-2f0102f3a9d2","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T18:14:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"42a74be0-8004-4735-8b0b-509db86e6789","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:60410","PortSpecifier":{"PortValue":60410}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"42a74be0-8004-4735-8b0b-509db86e6789","method":"POST","path":"/ai-tenant-e2e-shared-a-09d279/rate-test-model-09d279/v1/completions","host":"e2e-shared-a-09d279.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T18:14:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"42a74be0-8004-4735-8b0b-509db86e6789","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:60410","PortSpecifier":{"PortValue":60410}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783620874,"nanos":360713480},"http":{"id":"42a74be0-8004-4735-8b0b-509db86e6789","method":"POST","headers":{":authority":"e2e-shared-a-09d279.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-09d279/rate-test-model-09d279/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:14:34Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"42a74be0-8004-4735-8b0b-509db86e6789","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1PxzonwpH86SUaqow_Y7CrXW6Bdl1InJA48k8tA7fH8rD7Ho4Z7Ih03NxWzq6"}
{"level":"debug","ts":"2026-07-09T18:14:34Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"42a74be0-8004-4735-8b0b-509db86e6789","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-09d279.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1PxzonwpH86SUaqow_Y7CrXW6Bdl1InJA48k8tA7fH8rD7Ho4Z7Ih03NxWzq6\"}"}
{"level":"debug","ts":"2026-07-09T18:14:34Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"42a74be0-8004-4735-8b0b-509db86e6789","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-09d279.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"30b23380-1b43-43ca-91d1-6f19a5186e63","keyName":"e2e-rate-a-b6ad11","subscription":"e2e-rate-iso-a-b6ad11","tenant":"e2e-shared-a-09d279","userId":"30b23380-1b43-43ca-91d1-6f19a5186e63","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T18:14:34Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"42a74be0-8004-4735-8b0b-509db86e6789","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-09d279.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-09d279/rate-test-model-09d279\",\"requestedSubscription\":\"e2e-rate-iso-a-b6ad11\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T18:14:34Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"42a74be0-8004-4735-8b0b-509db86e6789","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-09d279.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-09d279","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-b6ad11","namespace":"ai-tenant-e2e-shared-a-09d279","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T18:14:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"42a74be0-8004-4735-8b0b-509db86e6789","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:14:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"42a74be0-8004-4735-8b0b-509db86e6789","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"42a74be0-8004-4735-8b0b-509db86e6789","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"42a74be0-8004-4735-8b0b-509db86e6789","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-09d279/rate-test-model-09d279\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"42a74be0-8004-4735-8b0b-509db86e6789","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"42a74be0-8004-4735-8b0b-509db86e6789","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T18:14:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"42a74be0-8004-4735-8b0b-509db86e6789","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-b6ad11"}
{"level":"debug","ts":"2026-07-09T18:14:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"42a74be0-8004-4735-8b0b-509db86e6789","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T18:14:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"42a74be0-8004-4735-8b0b-509db86e6789","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"30b23380-1b43-43ca-91d1-6f19a5186e63","keyName":"e2e-rate-a-b6ad11","selected_subscription":"e2e-rate-iso-a-b6ad11","selected_subscription_key":"ai-tenant-e2e-shared-a-09d279/e2e-rate-iso-a-b6ad11@ai-tenant-e2e-shared-a-09d279/rate-test-model-09d279","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-09d279","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-b6ad11","namespace":"ai-tenant-e2e-shared-a-09d279","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T18:14:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"42a74be0-8004-4735-8b0b-509db86e6789","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T18:14:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"42a74be0-8004-4735-8b0b-509db86e6789","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T18:14:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6deaa62f-c248-4f83-a7c2-a111a8ab7222","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:60426","PortSpecifier":{"PortValue":60426}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6deaa62f-c248-4f83-a7c2-a111a8ab7222","method":"POST","path":"/ai-tenant-e2e-shared-a-09d279/rate-test-model-09d279/v1/completions","host":"e2e-shared-a-09d279.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T18:14:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6deaa62f-c248-4f83-a7c2-a111a8ab7222","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:60426","PortSpecifier":{"PortValue":60426}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783620875,"nanos":397257023},"http":{"id":"6deaa62f-c248-4f83-a7c2-a111a8ab7222","method":"POST","headers":{":authority":"e2e-shared-a-09d279.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-09d279/rate-test-model-09d279/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:14:35Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6deaa62f-c248-4f83-a7c2-a111a8ab7222","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1PxzonwpH86SUaqow_Y7CrXW6Bdl1InJA48k8tA7fH8rD7Ho4Z7Ih03NxWzq6"}
{"level":"debug","ts":"2026-07-09T18:14:35Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6deaa62f-c248-4f83-a7c2-a111a8ab7222","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-09d279.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1PxzonwpH86SUaqow_Y7CrXW6Bdl1InJA48k8tA7fH8rD7Ho4Z7Ih03NxWzq6\"}"}
{"level":"debug","ts":"2026-07-09T18:14:35Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6deaa62f-c248-4f83-a7c2-a111a8ab7222","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-09d279.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"30b23380-1b43-43ca-91d1-6f19a5186e63","keyName":"e2e-rate-a-b6ad11","subscription":"e2e-rate-iso-a-b6ad11","tenant":"e2e-shared-a-09d279","userId":"30b23380-1b43-43ca-91d1-6f19a5186e63","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T18:14:35Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6deaa62f-c248-4f83-a7c2-a111a8ab7222","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-09d279.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-09d279/rate-test-model-09d279\",\"requestedSubscription\":\"e2e-rate-iso-a-b6ad11\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T18:14:35Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6deaa62f-c248-4f83-a7c2-a111a8ab7222","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-09d279.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-09d279","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-b6ad11","namespace":"ai-tenant-e2e-shared-a-09d279","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T18:14:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6deaa62f-c248-4f83-a7c2-a111a8ab7222","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:14:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6deaa62f-c248-4f83-a7c2-a111a8ab7222","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6deaa62f-c248-4f83-a7c2-a111a8ab7222","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6deaa62f-c248-4f83-a7c2-a111a8ab7222","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6deaa62f-c248-4f83-a7c2-a111a8ab7222","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-09d279/rate-test-model-09d279\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6deaa62f-c248-4f83-a7c2-a111a8ab7222","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T18:14:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6deaa62f-c248-4f83-a7c2-a111a8ab7222","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-b6ad11"}
{"level":"debug","ts":"2026-07-09T18:14:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6deaa62f-c248-4f83-a7c2-a111a8ab7222","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T18:14:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6deaa62f-c248-4f83-a7c2-a111a8ab7222","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"30b23380-1b43-43ca-91d1-6f19a5186e63","keyName":"e2e-rate-a-b6ad11","selected_subscription":"e2e-rate-iso-a-b6ad11","selected_subscription_key":"ai-tenant-e2e-shared-a-09d279/e2e-rate-iso-a-b6ad11@ai-tenant-e2e-shared-a-09d279/rate-test-model-09d279","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-09d279","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-b6ad11","namespace":"ai-tenant-e2e-shared-a-09d279","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T18:14:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6deaa62f-c248-4f83-a7c2-a111a8ab7222","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T18:14:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6deaa62f-c248-4f83-a7c2-a111a8ab7222","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T18:14:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6567db8c-eb89-4ade-8d04-11dc1a776341","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:55218","PortSpecifier":{"PortValue":55218}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6567db8c-eb89-4ade-8d04-11dc1a776341","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-09d279.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T18:14:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6567db8c-eb89-4ade-8d04-11dc1a776341","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:55218","PortSpecifier":{"PortValue":55218}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783620886,"nanos":254271678},"http":{"id":"6567db8c-eb89-4ade-8d04-11dc1a776341","method":"POST","headers":{":authority":"e2e-shared-a-09d279.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:14:46Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"6567db8c-eb89-4ade-8d04-11dc1a776341","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T18:14:46Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6567db8c-eb89-4ade-8d04-11dc1a776341","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"8a03aca8-c185-4c8a-b6bd-33878f9e863c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=d0cd2685-b2e1-4705-9a11-a82c8e44ad44"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab31c6ab9b00"]}}
{"level":"debug","ts":"2026-07-09T18:14:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6567db8c-eb89-4ade-8d04-11dc1a776341","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab31c6ab9b00"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=d0cd2685-b2e1-4705-9a11-a82c8e44ad44"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"8a03aca8-c185-4c8a-b6bd-33878f9e863c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"6fff71fcd45a294412257cdd7721672479b46bddf883bead293812798aca2799"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.47:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-09d279.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:14:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6567db8c-eb89-4ade-8d04-11dc1a776341","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6567db8c-eb89-4ade-8d04-11dc1a776341","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6567db8c-eb89-4ade-8d04-11dc1a776341","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-09d279/rate-test-model-09d279\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"6567db8c-eb89-4ade-8d04-11dc1a776341","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T18:14:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6567db8c-eb89-4ade-8d04-11dc1a776341","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T18:14:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6567db8c-eb89-4ade-8d04-11dc1a776341","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-09T18:14:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6567db8c-eb89-4ade-8d04-11dc1a776341","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T18:14:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6567db8c-eb89-4ade-8d04-11dc1a776341","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T18:14:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2afae651-0c32-4650-a594-adb0394650f9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:34302","PortSpecifier":{"PortValue":34302}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2afae651-0c32-4650-a594-adb0394650f9","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-e0b9f9.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T18:14:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2afae651-0c32-4650-a594-adb0394650f9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:34302","PortSpecifier":{"PortValue":34302}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783620886,"nanos":289515372},"http":{"id":"2afae651-0c32-4650-a594-adb0394650f9","method":"POST","headers":{":authority":"e2e-shared-b-e0b9f9.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:14:46Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"2afae651-0c32-4650-a594-adb0394650f9","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T18:14:46Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2afae651-0c32-4650-a594-adb0394650f9","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"8a03aca8-c185-4c8a-b6bd-33878f9e863c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=d0cd2685-b2e1-4705-9a11-a82c8e44ad44"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab31c6ab9b00"]}}
{"level":"debug","ts":"2026-07-09T18:14:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2afae651-0c32-4650-a594-adb0394650f9","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab31c6ab9b00"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=d0cd2685-b2e1-4705-9a11-a82c8e44ad44"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"8a03aca8-c185-4c8a-b6bd-33878f9e863c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"3682972e0c81bfc88ef826fc0824c34a3a6f73b8888ffa4426c86a341dd9b2cc"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.48:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-e0b9f9.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:14:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2afae651-0c32-4650-a594-adb0394650f9","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2afae651-0c32-4650-a594-adb0394650f9","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2afae651-0c32-4650-a594-adb0394650f9","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-e0b9f9/rate-test-model-e0b9f9\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"2afae651-0c32-4650-a594-adb0394650f9","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T18:14:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2afae651-0c32-4650-a594-adb0394650f9","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T18:14:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2afae651-0c32-4650-a594-adb0394650f9","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-09T18:14:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2afae651-0c32-4650-a594-adb0394650f9","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T18:14:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2afae651-0c32-4650-a594-adb0394650f9","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T18:14:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f55e712c-bb56-49f1-b31e-91c723208793","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:55224","PortSpecifier":{"PortValue":55224}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f55e712c-bb56-49f1-b31e-91c723208793","method":"POST","path":"/ai-tenant-e2e-shared-a-09d279/rate-test-model-09d279/v1/completions","host":"e2e-shared-a-09d279.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T18:14:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f55e712c-bb56-49f1-b31e-91c723208793","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:55224","PortSpecifier":{"PortValue":55224}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783620886,"nanos":329030995},"http":{"id":"f55e712c-bb56-49f1-b31e-91c723208793","method":"POST","headers":{":authority":"e2e-shared-a-09d279.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-09d279/rate-test-model-09d279/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:14:46Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f55e712c-bb56-49f1-b31e-91c723208793","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-cjgJDF9SqNZd9sgP_ZEWDjrwk3Sov0vBKnM3euLnwCwRr7Zo4MPLtUghPdWm"}
{"level":"debug","ts":"2026-07-09T18:14:46Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f55e712c-bb56-49f1-b31e-91c723208793","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-09d279.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-cjgJDF9SqNZd9sgP_ZEWDjrwk3Sov0vBKnM3euLnwCwRr7Zo4MPLtUghPdWm\"}"}
{"level":"debug","ts":"2026-07-09T18:14:46Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f55e712c-bb56-49f1-b31e-91c723208793","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-09d279.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"c1d040b8-c166-4f32-b292-dc6ec799b49f","keyName":"e2e-rate-a-96f763","subscription":"e2e-rate-iso-a-96f763","tenant":"e2e-shared-a-09d279","userId":"c1d040b8-c166-4f32-b292-dc6ec799b49f","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T18:14:46Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f55e712c-bb56-49f1-b31e-91c723208793","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-09d279.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-09d279/rate-test-model-09d279\",\"requestedSubscription\":\"e2e-rate-iso-a-96f763\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T18:14:46Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f55e712c-bb56-49f1-b31e-91c723208793","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-09d279.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-09d279","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-96f763","namespace":"ai-tenant-e2e-shared-a-09d279","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T18:14:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f55e712c-bb56-49f1-b31e-91c723208793","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:14:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f55e712c-bb56-49f1-b31e-91c723208793","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f55e712c-bb56-49f1-b31e-91c723208793","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f55e712c-bb56-49f1-b31e-91c723208793","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-09d279/rate-test-model-09d279\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f55e712c-bb56-49f1-b31e-91c723208793","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f55e712c-bb56-49f1-b31e-91c723208793","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T18:14:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f55e712c-bb56-49f1-b31e-91c723208793","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-96f763"}
{"level":"debug","ts":"2026-07-09T18:14:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f55e712c-bb56-49f1-b31e-91c723208793","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T18:14:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f55e712c-bb56-49f1-b31e-91c723208793","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"c1d040b8-c166-4f32-b292-dc6ec799b49f","keyName":"e2e-rate-a-96f763","selected_subscription":"e2e-rate-iso-a-96f763","selected_subscription_key":"ai-tenant-e2e-shared-a-09d279/e2e-rate-iso-a-96f763@ai-tenant-e2e-shared-a-09d279/rate-test-model-09d279","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-09d279","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-96f763","namespace":"ai-tenant-e2e-shared-a-09d279","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T18:14:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f55e712c-bb56-49f1-b31e-91c723208793","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T18:14:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f55e712c-bb56-49f1-b31e-91c723208793","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T18:14:47Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5e84eb68-c31e-4970-9789-09d2cedf21e8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:39984","PortSpecifier":{"PortValue":39984}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5e84eb68-c31e-4970-9789-09d2cedf21e8","method":"POST","path":"/ai-tenant-e2e-shared-a-09d279/rate-test-model-09d279/v1/completions","host":"e2e-shared-a-09d279.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T18:14:47Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5e84eb68-c31e-4970-9789-09d2cedf21e8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:39984","PortSpecifier":{"PortValue":39984}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783620887,"nanos":366807184},"http":{"id":"5e84eb68-c31e-4970-9789-09d2cedf21e8","method":"POST","headers":{":authority":"e2e-shared-a-09d279.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-09d279/rate-test-model-09d279/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:14:47Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5e84eb68-c31e-4970-9789-09d2cedf21e8","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-cjgJDF9SqNZd9sgP_ZEWDjrwk3Sov0vBKnM3euLnwCwRr7Zo4MPLtUghPdWm"}
{"level":"debug","ts":"2026-07-09T18:14:47Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5e84eb68-c31e-4970-9789-09d2cedf21e8","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-09d279.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-cjgJDF9SqNZd9sgP_ZEWDjrwk3Sov0vBKnM3euLnwCwRr7Zo4MPLtUghPdWm\"}"}
{"level":"debug","ts":"2026-07-09T18:14:47Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5e84eb68-c31e-4970-9789-09d2cedf21e8","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-09d279.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"c1d040b8-c166-4f32-b292-dc6ec799b49f","keyName":"e2e-rate-a-96f763","subscription":"e2e-rate-iso-a-96f763","tenant":"e2e-shared-a-09d279","userId":"c1d040b8-c166-4f32-b292-dc6ec799b49f","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T18:14:47Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5e84eb68-c31e-4970-9789-09d2cedf21e8","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-09d279.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-09d279/rate-test-model-09d279\",\"requestedSubscription\":\"e2e-rate-iso-a-96f763\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T18:14:47Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5e84eb68-c31e-4970-9789-09d2cedf21e8","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-09d279.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-09d279","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-96f763","namespace":"ai-tenant-e2e-shared-a-09d279","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T18:14:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5e84eb68-c31e-4970-9789-09d2cedf21e8","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:14:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5e84eb68-c31e-4970-9789-09d2cedf21e8","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5e84eb68-c31e-4970-9789-09d2cedf21e8","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5e84eb68-c31e-4970-9789-09d2cedf21e8","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-09d279/rate-test-model-09d279\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5e84eb68-c31e-4970-9789-09d2cedf21e8","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5e84eb68-c31e-4970-9789-09d2cedf21e8","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T18:14:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5e84eb68-c31e-4970-9789-09d2cedf21e8","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-96f763"}
{"level":"debug","ts":"2026-07-09T18:14:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5e84eb68-c31e-4970-9789-09d2cedf21e8","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T18:14:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5e84eb68-c31e-4970-9789-09d2cedf21e8","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"c1d040b8-c166-4f32-b292-dc6ec799b49f","keyName":"e2e-rate-a-96f763","selected_subscription":"e2e-rate-iso-a-96f763","selected_subscription_key":"ai-tenant-e2e-shared-a-09d279/e2e-rate-iso-a-96f763@ai-tenant-e2e-shared-a-09d279/rate-test-model-09d279","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-09d279","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-96f763","namespace":"ai-tenant-e2e-shared-a-09d279","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T18:14:47Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5e84eb68-c31e-4970-9789-09d2cedf21e8","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T18:14:47Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5e84eb68-c31e-4970-9789-09d2cedf21e8","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T18:14:48Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f5f24806-8a49-4566-99c7-2b28cf7532b0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:39986","PortSpecifier":{"PortValue":39986}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f5f24806-8a49-4566-99c7-2b28cf7532b0","method":"POST","path":"/ai-tenant-e2e-shared-a-09d279/rate-test-model-09d279/v1/completions","host":"e2e-shared-a-09d279.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T18:14:48Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f5f24806-8a49-4566-99c7-2b28cf7532b0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:39986","PortSpecifier":{"PortValue":39986}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783620888,"nanos":401492558},"http":{"id":"f5f24806-8a49-4566-99c7-2b28cf7532b0","method":"POST","headers":{":authority":"e2e-shared-a-09d279.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-09d279/rate-test-model-09d279/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:14:48Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f5f24806-8a49-4566-99c7-2b28cf7532b0","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-cjgJDF9SqNZd9sgP_ZEWDjrwk3Sov0vBKnM3euLnwCwRr7Zo4MPLtUghPdWm"}
{"level":"debug","ts":"2026-07-09T18:14:48Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f5f24806-8a49-4566-99c7-2b28cf7532b0","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-09d279.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-cjgJDF9SqNZd9sgP_ZEWDjrwk3Sov0vBKnM3euLnwCwRr7Zo4MPLtUghPdWm\"}"}
{"level":"debug","ts":"2026-07-09T18:14:48Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f5f24806-8a49-4566-99c7-2b28cf7532b0","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-09d279.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"c1d040b8-c166-4f32-b292-dc6ec799b49f","keyName":"e2e-rate-a-96f763","subscription":"e2e-rate-iso-a-96f763","tenant":"e2e-shared-a-09d279","userId":"c1d040b8-c166-4f32-b292-dc6ec799b49f","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T18:14:48Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f5f24806-8a49-4566-99c7-2b28cf7532b0","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-09d279.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-09d279/rate-test-model-09d279\",\"requestedSubscription\":\"e2e-rate-iso-a-96f763\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T18:14:48Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f5f24806-8a49-4566-99c7-2b28cf7532b0","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-09d279.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-09d279","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-96f763","namespace":"ai-tenant-e2e-shared-a-09d279","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T18:14:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f5f24806-8a49-4566-99c7-2b28cf7532b0","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:14:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f5f24806-8a49-4566-99c7-2b28cf7532b0","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f5f24806-8a49-4566-99c7-2b28cf7532b0","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f5f24806-8a49-4566-99c7-2b28cf7532b0","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-09d279/rate-test-model-09d279\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f5f24806-8a49-4566-99c7-2b28cf7532b0","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f5f24806-8a49-4566-99c7-2b28cf7532b0","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T18:14:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f5f24806-8a49-4566-99c7-2b28cf7532b0","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-96f763"}
{"level":"debug","ts":"2026-07-09T18:14:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f5f24806-8a49-4566-99c7-2b28cf7532b0","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T18:14:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f5f24806-8a49-4566-99c7-2b28cf7532b0","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"c1d040b8-c166-4f32-b292-dc6ec799b49f","keyName":"e2e-rate-a-96f763","selected_subscription":"e2e-rate-iso-a-96f763","selected_subscription_key":"ai-tenant-e2e-shared-a-09d279/e2e-rate-iso-a-96f763@ai-tenant-e2e-shared-a-09d279/rate-test-model-09d279","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-09d279","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-96f763","namespace":"ai-tenant-e2e-shared-a-09d279","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T18:14:48Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f5f24806-8a49-4566-99c7-2b28cf7532b0","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T18:14:48Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f5f24806-8a49-4566-99c7-2b28cf7532b0","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T18:14:48Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2f791be6-d8e3-431b-833e-38a3bdcbe388","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:36406","PortSpecifier":{"PortValue":36406}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2f791be6-d8e3-431b-833e-38a3bdcbe388","method":"POST","path":"/ai-tenant-e2e-shared-b-e0b9f9/rate-test-model-e0b9f9/v1/completions","host":"e2e-shared-b-e0b9f9.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T18:14:48Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2f791be6-d8e3-431b-833e-38a3bdcbe388","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:36406","PortSpecifier":{"PortValue":36406}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783620888,"nanos":436446169},"http":{"id":"2f791be6-d8e3-431b-833e-38a3bdcbe388","method":"POST","headers":{":authority":"e2e-shared-b-e0b9f9.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-e0b9f9/rate-test-model-e0b9f9/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:14:48Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2f791be6-d8e3-431b-833e-38a3bdcbe388","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-11UK6VswEcrg0qyZ2_rgs4OFRNNWKXqPoH8KcS5WRfpTaB1zKJq9ikb5p7HiX"}
{"level":"debug","ts":"2026-07-09T18:14:48Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2f791be6-d8e3-431b-833e-38a3bdcbe388","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-e0b9f9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-11UK6VswEcrg0qyZ2_rgs4OFRNNWKXqPoH8KcS5WRfpTaB1zKJq9ikb5p7HiX\"}"}
{"level":"debug","ts":"2026-07-09T18:14:48Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2f791be6-d8e3-431b-833e-38a3bdcbe388","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-e0b9f9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"f740e289-c586-4e96-aa1e-15c1e922165b","keyName":"e2e-rate-b-96f763","subscription":"e2e-rate-iso-b-96f763","tenant":"e2e-shared-b-e0b9f9","userId":"f740e289-c586-4e96-aa1e-15c1e922165b","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T18:14:48Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2f791be6-d8e3-431b-833e-38a3bdcbe388","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-e0b9f9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-e0b9f9/rate-test-model-e0b9f9\",\"requestedSubscription\":\"e2e-rate-iso-b-96f763\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T18:14:48Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2f791be6-d8e3-431b-833e-38a3bdcbe388","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-e0b9f9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-e0b9f9","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-96f763","namespace":"ai-tenant-e2e-shared-b-e0b9f9","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T18:14:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2f791be6-d8e3-431b-833e-38a3bdcbe388","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:14:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2f791be6-d8e3-431b-833e-38a3bdcbe388","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2f791be6-d8e3-431b-833e-38a3bdcbe388","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2f791be6-d8e3-431b-833e-38a3bdcbe388","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-e0b9f9/rate-test-model-e0b9f9\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2f791be6-d8e3-431b-833e-38a3bdcbe388","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2f791be6-d8e3-431b-833e-38a3bdcbe388","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-96f763"}
{"level":"debug","ts":"2026-07-09T18:14:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2f791be6-d8e3-431b-833e-38a3bdcbe388","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T18:14:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2f791be6-d8e3-431b-833e-38a3bdcbe388","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T18:14:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2f791be6-d8e3-431b-833e-38a3bdcbe388","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"f740e289-c586-4e96-aa1e-15c1e922165b","keyName":"e2e-rate-b-96f763","selected_subscription":"e2e-rate-iso-b-96f763","selected_subscription_key":"ai-tenant-e2e-shared-b-e0b9f9/e2e-rate-iso-b-96f763@ai-tenant-e2e-shared-b-e0b9f9/rate-test-model-e0b9f9","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-e0b9f9","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-96f763","namespace":"ai-tenant-e2e-shared-b-e0b9f9","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T18:14:48Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2f791be6-d8e3-431b-833e-38a3bdcbe388","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T18:14:48Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2f791be6-d8e3-431b-833e-38a3bdcbe388","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T18:14:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"60f14a4b-5012-4256-8a73-64bd7a59230b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:47792","PortSpecifier":{"PortValue":47792}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.32:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"60f14a4b-5012-4256-8a73-64bd7a59230b","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T18:14:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"60f14a4b-5012-4256-8a73-64bd7a59230b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:47792","PortSpecifier":{"PortValue":47792}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.32:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783620895,"nanos":947412589},"http":{"id":"60f14a4b-5012-4256-8a73-64bd7a59230b","method":"POST","headers":{":authority":"maas.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:14:55Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"60f14a4b-5012-4256-8a73-64bd7a59230b","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T18:14:55Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"60f14a4b-5012-4256-8a73-64bd7a59230b","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"8a03aca8-c185-4c8a-b6bd-33878f9e863c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=d0cd2685-b2e1-4705-9a11-a82c8e44ad44"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab31c6ab9b00"]}}
{"level":"debug","ts":"2026-07-09T18:14:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"60f14a4b-5012-4256-8a73-64bd7a59230b","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab31c6ab9b00"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=d0cd2685-b2e1-4705-9a11-a82c8e44ad44"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"8a03aca8-c185-4c8a-b6bd-33878f9e863c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.32:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:14:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"60f14a4b-5012-4256-8a73-64bd7a59230b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"60f14a4b-5012-4256-8a73-64bd7a59230b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"60f14a4b-5012-4256-8a73-64bd7a59230b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"60f14a4b-5012-4256-8a73-64bd7a59230b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T18:14:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"60f14a4b-5012-4256-8a73-64bd7a59230b","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T18:14:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"60f14a4b-5012-4256-8a73-64bd7a59230b","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T18:14:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"60f14a4b-5012-4256-8a73-64bd7a59230b","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T18:14:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"60f14a4b-5012-4256-8a73-64bd7a59230b","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T18:14:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6cb5b919-d431-4d78-96f3-3f9dbc1ccdff","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:47800","PortSpecifier":{"PortValue":47800}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.32:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6cb5b919-d431-4d78-96f3-3f9dbc1ccdff","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T18:14:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6cb5b919-d431-4d78-96f3-3f9dbc1ccdff","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:47800","PortSpecifier":{"PortValue":47800}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.32:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783620895,"nanos":996176689},"http":{"id":"6cb5b919-d431-4d78-96f3-3f9dbc1ccdff","method":"POST","headers":{":authority":"maas.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:14:55Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"6cb5b919-d431-4d78-96f3-3f9dbc1ccdff","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6cb5b919-d431-4d78-96f3-3f9dbc1ccdff","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"8a03aca8-c185-4c8a-b6bd-33878f9e863c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=d0cd2685-b2e1-4705-9a11-a82c8e44ad44"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab31c6ab9b00"]}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6cb5b919-d431-4d78-96f3-3f9dbc1ccdff","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab31c6ab9b00"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=d0cd2685-b2e1-4705-9a11-a82c8e44ad44"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"8a03aca8-c185-4c8a-b6bd-33878f9e863c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.32:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6cb5b919-d431-4d78-96f3-3f9dbc1ccdff","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6cb5b919-d431-4d78-96f3-3f9dbc1ccdff","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6cb5b919-d431-4d78-96f3-3f9dbc1ccdff","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"6cb5b919-d431-4d78-96f3-3f9dbc1ccdff","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6cb5b919-d431-4d78-96f3-3f9dbc1ccdff","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6cb5b919-d431-4d78-96f3-3f9dbc1ccdff","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6cb5b919-d431-4d78-96f3-3f9dbc1ccdff","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6cb5b919-d431-4d78-96f3-3f9dbc1ccdff","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e23d44f5-f443-4093-aedd-8508202306cf","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:47808","PortSpecifier":{"PortValue":47808}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.32:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e23d44f5-f443-4093-aedd-8508202306cf","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e23d44f5-f443-4093-aedd-8508202306cf","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:47808","PortSpecifier":{"PortValue":47808}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.32:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783620896,"nanos":31099083},"http":{"id":"e23d44f5-f443-4093-aedd-8508202306cf","method":"POST","headers":{":authority":"maas.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"e23d44f5-f443-4093-aedd-8508202306cf","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e23d44f5-f443-4093-aedd-8508202306cf","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"8a03aca8-c185-4c8a-b6bd-33878f9e863c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=d0cd2685-b2e1-4705-9a11-a82c8e44ad44"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab31c6ab9b00"]}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e23d44f5-f443-4093-aedd-8508202306cf","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab31c6ab9b00"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=d0cd2685-b2e1-4705-9a11-a82c8e44ad44"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"8a03aca8-c185-4c8a-b6bd-33878f9e863c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.32:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e23d44f5-f443-4093-aedd-8508202306cf","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e23d44f5-f443-4093-aedd-8508202306cf","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e23d44f5-f443-4093-aedd-8508202306cf","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"e23d44f5-f443-4093-aedd-8508202306cf","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e23d44f5-f443-4093-aedd-8508202306cf","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e23d44f5-f443-4093-aedd-8508202306cf","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e23d44f5-f443-4093-aedd-8508202306cf","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e23d44f5-f443-4093-aedd-8508202306cf","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ffd76be1-3ae4-4571-b2a9-6639b88f8524","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:47810","PortSpecifier":{"PortValue":47810}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.32:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ffd76be1-3ae4-4571-b2a9-6639b88f8524","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ffd76be1-3ae4-4571-b2a9-6639b88f8524","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:47810","PortSpecifier":{"PortValue":47810}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.32:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783620896,"nanos":67879667},"http":{"id":"ffd76be1-3ae4-4571-b2a9-6639b88f8524","method":"POST","headers":{":authority":"maas.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"ffd76be1-3ae4-4571-b2a9-6639b88f8524","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ffd76be1-3ae4-4571-b2a9-6639b88f8524","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"8a03aca8-c185-4c8a-b6bd-33878f9e863c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=d0cd2685-b2e1-4705-9a11-a82c8e44ad44"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab31c6ab9b00"]}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ffd76be1-3ae4-4571-b2a9-6639b88f8524","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab31c6ab9b00"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=d0cd2685-b2e1-4705-9a11-a82c8e44ad44"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"8a03aca8-c185-4c8a-b6bd-33878f9e863c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.32:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ffd76be1-3ae4-4571-b2a9-6639b88f8524","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ffd76be1-3ae4-4571-b2a9-6639b88f8524","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ffd76be1-3ae4-4571-b2a9-6639b88f8524","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"ffd76be1-3ae4-4571-b2a9-6639b88f8524","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ffd76be1-3ae4-4571-b2a9-6639b88f8524","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ffd76be1-3ae4-4571-b2a9-6639b88f8524","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ffd76be1-3ae4-4571-b2a9-6639b88f8524","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ffd76be1-3ae4-4571-b2a9-6639b88f8524","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b6807113-9805-4d4b-a0a6-08e551580d1b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:47818","PortSpecifier":{"PortValue":47818}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.32:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b6807113-9805-4d4b-a0a6-08e551580d1b","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b6807113-9805-4d4b-a0a6-08e551580d1b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:47818","PortSpecifier":{"PortValue":47818}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.32:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783620896,"nanos":97241620},"http":{"id":"b6807113-9805-4d4b-a0a6-08e551580d1b","method":"GET","headers":{":authority":"maas.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b6807113-9805-4d4b-a0a6-08e551580d1b","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1LWN15ZqIaBfFHTG4_xruZABCFoujtGhGIbraCvupJK6Lfke8OVUppzM44KOS"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b6807113-9805-4d4b-a0a6-08e551580d1b","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1LWN15ZqIaBfFHTG4_xruZABCFoujtGhGIbraCvupJK6Lfke8OVUppzM44KOS\"}"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b6807113-9805-4d4b-a0a6-08e551580d1b","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"56ce1130-d48b-46f5-aa43-6c6bd382b7e0","keyName":"e2e-revoketest-a-0","subscription":"e2e-revoke-sub-a","tenant":"models-as-a-service","userId":"56ce1130-d48b-46f5-aa43-6c6bd382b7e0","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b6807113-9805-4d4b-a0a6-08e551580d1b","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b6807113-9805-4d4b-a0a6-08e551580d1b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b6807113-9805-4d4b-a0a6-08e551580d1b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b6807113-9805-4d4b-a0a6-08e551580d1b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b6807113-9805-4d4b-a0a6-08e551580d1b","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b6807113-9805-4d4b-a0a6-08e551580d1b","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b6807113-9805-4d4b-a0a6-08e551580d1b","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-a"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"b6807113-9805-4d4b-a0a6-08e551580d1b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b6807113-9805-4d4b-a0a6-08e551580d1b","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b6807113-9805-4d4b-a0a6-08e551580d1b","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4cdcfef7-6d7d-486e-8695-ee295c99ea8b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.35:58350","PortSpecifier":{"PortValue":58350}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.32:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"4cdcfef7-6d7d-486e-8695-ee295c99ea8b","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4cdcfef7-6d7d-486e-8695-ee295c99ea8b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.35:58350","PortSpecifier":{"PortValue":58350}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.32:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783620896,"nanos":122558079},"http":{"id":"4cdcfef7-6d7d-486e-8695-ee295c99ea8b","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"4cdcfef7-6d7d-486e-8695-ee295c99ea8b","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1LWN15ZqIaBfFHTG4_xruZABCFoujtGhGIbraCvupJK6Lfke8OVUppzM44KOS"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"4cdcfef7-6d7d-486e-8695-ee295c99ea8b","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1LWN15ZqIaBfFHTG4_xruZABCFoujtGhGIbraCvupJK6Lfke8OVUppzM44KOS\"}"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"4cdcfef7-6d7d-486e-8695-ee295c99ea8b","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"56ce1130-d48b-46f5-aa43-6c6bd382b7e0","keyName":"e2e-revoketest-a-0","subscription":"e2e-revoke-sub-a","tenant":"models-as-a-service","userId":"56ce1130-d48b-46f5-aa43-6c6bd382b7e0","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"4cdcfef7-6d7d-486e-8695-ee295c99ea8b","config":"subscription-info","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"e2e-revoke-sub-a\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"4cdcfef7-6d7d-486e-8695-ee295c99ea8b","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-a","namespace":"models-as-a-service","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"4cdcfef7-6d7d-486e-8695-ee295c99ea8b","input":{"auth":{"identity":"Bearer **** simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-a","namespace":"models-as-a-service","phase":"Active","ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.32:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-1LWN15ZqIaBfFHTG4_xruZABCFoujtGhGIbraCvupJK6Lfke8OVUppzM44KOS","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.132.0.35","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctcjk2Z3YKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.32~maas-default-gateway-openshift-default-56654dcf7-r96gv.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.35","x-forwarded-proto":"https","x-maas-subscription":"e2e-revoke-sub-a","x-request-id":"4cdcfef7-6d7d-486e-8695-ee295c99ea8b"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"4cdcfef7-6d7d-486e-8695-ee295c99ea8b","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":122558079,"seconds":1783620896},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.35:58350","port":58350}}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4cdcfef7-6d7d-486e-8695-ee295c99ea8b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4cdcfef7-6d7d-486e-8695-ee295c99ea8b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4cdcfef7-6d7d-486e-8695-ee295c99ea8b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4cdcfef7-6d7d-486e-8695-ee295c99ea8b","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4cdcfef7-6d7d-486e-8695-ee295c99ea8b","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4cdcfef7-6d7d-486e-8695-ee295c99ea8b","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-a"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4cdcfef7-6d7d-486e-8695-ee295c99ea8b","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4cdcfef7-6d7d-486e-8695-ee295c99ea8b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"56ce1130-d48b-46f5-aa43-6c6bd382b7e0","keyName":"e2e-revoketest-a-0","selected_subscription":"e2e-revoke-sub-a","selected_subscription_key":"models-as-a-service/e2e-revoke-sub-a@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-a","namespace":"models-as-a-service","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4cdcfef7-6d7d-486e-8695-ee295c99ea8b","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4cdcfef7-6d7d-486e-8695-ee295c99ea8b","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"03c14014-61c8-4abf-bd2c-ae0138fd1bdc","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:47828","PortSpecifier":{"PortValue":47828}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.32:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"03c14014-61c8-4abf-bd2c-ae0138fd1bdc","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"03c14014-61c8-4abf-bd2c-ae0138fd1bdc","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:47828","PortSpecifier":{"PortValue":47828}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.32:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783620896,"nanos":156228684},"http":{"id":"03c14014-61c8-4abf-bd2c-ae0138fd1bdc","method":"GET","headers":{":authority":"maas.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"03c14014-61c8-4abf-bd2c-ae0138fd1bdc","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1o3FKk1o3XuBqS0p_6yxRZ94cSZLaLEtXQZ0lkQ27Mhjvyi4j52MYTsm0s5d"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"03c14014-61c8-4abf-bd2c-ae0138fd1bdc","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1o3FKk1o3XuBqS0p_6yxRZ94cSZLaLEtXQZ0lkQ27Mhjvyi4j52MYTsm0s5d\"}"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"03c14014-61c8-4abf-bd2c-ae0138fd1bdc","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"d48bcc6d-db99-4108-9863-a2274ae23507","keyName":"e2e-revoketest-a-1","subscription":"e2e-revoke-sub-a","tenant":"models-as-a-service","userId":"d48bcc6d-db99-4108-9863-a2274ae23507","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"03c14014-61c8-4abf-bd2c-ae0138fd1bdc","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"03c14014-61c8-4abf-bd2c-ae0138fd1bdc","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"03c14014-61c8-4abf-bd2c-ae0138fd1bdc","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"03c14014-61c8-4abf-bd2c-ae0138fd1bdc","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"03c14014-61c8-4abf-bd2c-ae0138fd1bdc","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"03c14014-61c8-4abf-bd2c-ae0138fd1bdc","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-a"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"03c14014-61c8-4abf-bd2c-ae0138fd1bdc","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"03c14014-61c8-4abf-bd2c-ae0138fd1bdc","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"03c14014-61c8-4abf-bd2c-ae0138fd1bdc","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"03c14014-61c8-4abf-bd2c-ae0138fd1bdc","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"91ed0417-deaf-47e6-9a80-7ede7ced87e0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.35:58350","PortSpecifier":{"PortValue":58350}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.32:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"91ed0417-deaf-47e6-9a80-7ede7ced87e0","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"91ed0417-deaf-47e6-9a80-7ede7ced87e0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.35:58350","PortSpecifier":{"PortValue":58350}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.32:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783620896,"nanos":163245687},"http":{"id":"91ed0417-deaf-47e6-9a80-7ede7ced87e0","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"91ed0417-deaf-47e6-9a80-7ede7ced87e0","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1o3FKk1o3XuBqS0p_6yxRZ94cSZLaLEtXQZ0lkQ27Mhjvyi4j52MYTsm0s5d"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"91ed0417-deaf-47e6-9a80-7ede7ced87e0","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1o3FKk1o3XuBqS0p_6yxRZ94cSZLaLEtXQZ0lkQ27Mhjvyi4j52MYTsm0s5d\"}"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"91ed0417-deaf-47e6-9a80-7ede7ced87e0","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"d48bcc6d-db99-4108-9863-a2274ae23507","keyName":"e2e-revoketest-a-1","subscription":"e2e-revoke-sub-a","tenant":"models-as-a-service","userId":"d48bcc6d-db99-4108-9863-a2274ae23507","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"91ed0417-deaf-47e6-9a80-7ede7ced87e0","config":"subscription-info","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"e2e-revoke-sub-a\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"91ed0417-deaf-47e6-9a80-7ede7ced87e0","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-a","namespace":"models-as-a-service","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"91ed0417-deaf-47e6-9a80-7ede7ced87e0","input":{"auth":{"identity":"Bearer **** simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-a","namespace":"models-as-a-service","phase":"Active","ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.32:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-1o3FKk1o3XuBqS0p_6yxRZ94cSZLaLEtXQZ0lkQ27Mhjvyi4j52MYTsm0s5d","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.132.0.35","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctcjk2Z3YKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.32~maas-default-gateway-openshift-default-56654dcf7-r96gv.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.35","x-forwarded-proto":"https","x-maas-subscription":"e2e-revoke-sub-a","x-request-id":"91ed0417-deaf-47e6-9a80-7ede7ced87e0"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"91ed0417-deaf-47e6-9a80-7ede7ced87e0","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":163245687,"seconds":1783620896},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.35:58350","port":58350}}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"91ed0417-deaf-47e6-9a80-7ede7ced87e0","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"91ed0417-deaf-47e6-9a80-7ede7ced87e0","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"91ed0417-deaf-47e6-9a80-7ede7ced87e0","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"91ed0417-deaf-47e6-9a80-7ede7ced87e0","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"91ed0417-deaf-47e6-9a80-7ede7ced87e0","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"91ed0417-deaf-47e6-9a80-7ede7ced87e0","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-a"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"91ed0417-deaf-47e6-9a80-7ede7ced87e0","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"91ed0417-deaf-47e6-9a80-7ede7ced87e0","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"d48bcc6d-db99-4108-9863-a2274ae23507","keyName":"e2e-revoketest-a-1","selected_subscription":"e2e-revoke-sub-a","selected_subscription_key":"models-as-a-service/e2e-revoke-sub-a@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-a","namespace":"models-as-a-service","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"91ed0417-deaf-47e6-9a80-7ede7ced87e0","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"91ed0417-deaf-47e6-9a80-7ede7ced87e0","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c89a6970-e4b6-4358-9df9-d8f62ae9afe3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:47838","PortSpecifier":{"PortValue":47838}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.32:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c89a6970-e4b6-4358-9df9-d8f62ae9afe3","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c89a6970-e4b6-4358-9df9-d8f62ae9afe3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:47838","PortSpecifier":{"PortValue":47838}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.32:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783620896,"nanos":195590769},"http":{"id":"c89a6970-e4b6-4358-9df9-d8f62ae9afe3","method":"GET","headers":{":authority":"maas.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"c89a6970-e4b6-4358-9df9-d8f62ae9afe3","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-4YmCPtiYCBrIR6kE_C2hO76fEDXkaBtlXrVvqA4L9qPQKdOU4uFVZGKeMjWA"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c89a6970-e4b6-4358-9df9-d8f62ae9afe3","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-4YmCPtiYCBrIR6kE_C2hO76fEDXkaBtlXrVvqA4L9qPQKdOU4uFVZGKeMjWA\"}"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c89a6970-e4b6-4358-9df9-d8f62ae9afe3","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"5dc31811-6dad-4a22-ad6c-721ad9088429","keyName":"e2e-revoketest-b-0","subscription":"e2e-revoke-sub-b","tenant":"models-as-a-service","userId":"5dc31811-6dad-4a22-ad6c-721ad9088429","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"c89a6970-e4b6-4358-9df9-d8f62ae9afe3","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c89a6970-e4b6-4358-9df9-d8f62ae9afe3","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c89a6970-e4b6-4358-9df9-d8f62ae9afe3","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c89a6970-e4b6-4358-9df9-d8f62ae9afe3","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c89a6970-e4b6-4358-9df9-d8f62ae9afe3","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c89a6970-e4b6-4358-9df9-d8f62ae9afe3","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-b"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c89a6970-e4b6-4358-9df9-d8f62ae9afe3","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"c89a6970-e4b6-4358-9df9-d8f62ae9afe3","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c89a6970-e4b6-4358-9df9-d8f62ae9afe3","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c89a6970-e4b6-4358-9df9-d8f62ae9afe3","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5feb0894-6638-48af-bcd8-17f33e57d446","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.35:58350","PortSpecifier":{"PortValue":58350}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.32:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5feb0894-6638-48af-bcd8-17f33e57d446","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5feb0894-6638-48af-bcd8-17f33e57d446","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.35:58350","PortSpecifier":{"PortValue":58350}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.32:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783620896,"nanos":204444595},"http":{"id":"5feb0894-6638-48af-bcd8-17f33e57d446","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5feb0894-6638-48af-bcd8-17f33e57d446","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-4YmCPtiYCBrIR6kE_C2hO76fEDXkaBtlXrVvqA4L9qPQKdOU4uFVZGKeMjWA"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5feb0894-6638-48af-bcd8-17f33e57d446","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-4YmCPtiYCBrIR6kE_C2hO76fEDXkaBtlXrVvqA4L9qPQKdOU4uFVZGKeMjWA\"}"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5feb0894-6638-48af-bcd8-17f33e57d446","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"5dc31811-6dad-4a22-ad6c-721ad9088429","keyName":"e2e-revoketest-b-0","subscription":"e2e-revoke-sub-b","tenant":"models-as-a-service","userId":"5dc31811-6dad-4a22-ad6c-721ad9088429","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5feb0894-6638-48af-bcd8-17f33e57d446","config":"subscription-info","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"e2e-revoke-sub-b\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5feb0894-6638-48af-bcd8-17f33e57d446","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5feb0894-6638-48af-bcd8-17f33e57d446","input":{"auth":{"identity":"Bearer **** simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.32:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-4YmCPtiYCBrIR6kE_C2hO76fEDXkaBtlXrVvqA4L9qPQKdOU4uFVZGKeMjWA","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.132.0.35","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctcjk2Z3YKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.32~maas-default-gateway-openshift-default-56654dcf7-r96gv.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.35","x-forwarded-proto":"https","x-maas-subscription":"e2e-revoke-sub-b","x-request-id":"5feb0894-6638-48af-bcd8-17f33e57d446"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"5feb0894-6638-48af-bcd8-17f33e57d446","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":204444595,"seconds":1783620896},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.35:58350","port":58350}}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5feb0894-6638-48af-bcd8-17f33e57d446","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5feb0894-6638-48af-bcd8-17f33e57d446","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5feb0894-6638-48af-bcd8-17f33e57d446","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5feb0894-6638-48af-bcd8-17f33e57d446","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5feb0894-6638-48af-bcd8-17f33e57d446","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5feb0894-6638-48af-bcd8-17f33e57d446","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5feb0894-6638-48af-bcd8-17f33e57d446","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-b"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5feb0894-6638-48af-bcd8-17f33e57d446","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"5dc31811-6dad-4a22-ad6c-721ad9088429","keyName":"e2e-revoketest-b-0","selected_subscription":"e2e-revoke-sub-b","selected_subscription_key":"models-as-a-service/e2e-revoke-sub-b@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5feb0894-6638-48af-bcd8-17f33e57d446","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5feb0894-6638-48af-bcd8-17f33e57d446","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"63370153-61ba-403b-b6f5-f1c39e9edcb4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:47852","PortSpecifier":{"PortValue":47852}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.32:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"63370153-61ba-403b-b6f5-f1c39e9edcb4","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"63370153-61ba-403b-b6f5-f1c39e9edcb4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:47852","PortSpecifier":{"PortValue":47852}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.32:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783620896,"nanos":232681841},"http":{"id":"63370153-61ba-403b-b6f5-f1c39e9edcb4","method":"GET","headers":{":authority":"maas.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"63370153-61ba-403b-b6f5-f1c39e9edcb4","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1SGy357CdCyLd9Vwd_RBWiaPaCZEVzl4ueAb0bL4AfUeOeAu7fAjmjcZJRQnH"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"63370153-61ba-403b-b6f5-f1c39e9edcb4","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1SGy357CdCyLd9Vwd_RBWiaPaCZEVzl4ueAb0bL4AfUeOeAu7fAjmjcZJRQnH\"}"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"63370153-61ba-403b-b6f5-f1c39e9edcb4","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"fbd47ee6-d9b1-4ab2-ac4d-27fb711488df","keyName":"e2e-revoketest-b-1","subscription":"e2e-revoke-sub-b","tenant":"models-as-a-service","userId":"fbd47ee6-d9b1-4ab2-ac4d-27fb711488df","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"63370153-61ba-403b-b6f5-f1c39e9edcb4","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"63370153-61ba-403b-b6f5-f1c39e9edcb4","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"63370153-61ba-403b-b6f5-f1c39e9edcb4","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"63370153-61ba-403b-b6f5-f1c39e9edcb4","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"63370153-61ba-403b-b6f5-f1c39e9edcb4","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"63370153-61ba-403b-b6f5-f1c39e9edcb4","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"63370153-61ba-403b-b6f5-f1c39e9edcb4","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-b"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"63370153-61ba-403b-b6f5-f1c39e9edcb4","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"63370153-61ba-403b-b6f5-f1c39e9edcb4","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"63370153-61ba-403b-b6f5-f1c39e9edcb4","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d5590238-a9de-4078-843a-1a9838e5cac3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.35:58350","PortSpecifier":{"PortValue":58350}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.32:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d5590238-a9de-4078-843a-1a9838e5cac3","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d5590238-a9de-4078-843a-1a9838e5cac3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.35:58350","PortSpecifier":{"PortValue":58350}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.32:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783620896,"nanos":240398490},"http":{"id":"d5590238-a9de-4078-843a-1a9838e5cac3","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d5590238-a9de-4078-843a-1a9838e5cac3","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1SGy357CdCyLd9Vwd_RBWiaPaCZEVzl4ueAb0bL4AfUeOeAu7fAjmjcZJRQnH"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d5590238-a9de-4078-843a-1a9838e5cac3","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1SGy357CdCyLd9Vwd_RBWiaPaCZEVzl4ueAb0bL4AfUeOeAu7fAjmjcZJRQnH\"}"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d5590238-a9de-4078-843a-1a9838e5cac3","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"fbd47ee6-d9b1-4ab2-ac4d-27fb711488df","keyName":"e2e-revoketest-b-1","subscription":"e2e-revoke-sub-b","tenant":"models-as-a-service","userId":"fbd47ee6-d9b1-4ab2-ac4d-27fb711488df","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d5590238-a9de-4078-843a-1a9838e5cac3","config":"subscription-info","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"e2e-revoke-sub-b\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d5590238-a9de-4078-843a-1a9838e5cac3","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d5590238-a9de-4078-843a-1a9838e5cac3","input":{"auth":{"identity":"Bearer **** simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.32:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-1SGy357CdCyLd9Vwd_RBWiaPaCZEVzl4ueAb0bL4AfUeOeAu7fAjmjcZJRQnH","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.132.0.35","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctcjk2Z3YKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.32~maas-default-gateway-openshift-default-56654dcf7-r96gv.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.35","x-forwarded-proto":"https","x-maas-subscription":"e2e-revoke-sub-b","x-request-id":"d5590238-a9de-4078-843a-1a9838e5cac3"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"d5590238-a9de-4078-843a-1a9838e5cac3","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":240398490,"seconds":1783620896},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.35:58350","port":58350}}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d5590238-a9de-4078-843a-1a9838e5cac3","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d5590238-a9de-4078-843a-1a9838e5cac3","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d5590238-a9de-4078-843a-1a9838e5cac3","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d5590238-a9de-4078-843a-1a9838e5cac3","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d5590238-a9de-4078-843a-1a9838e5cac3","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d5590238-a9de-4078-843a-1a9838e5cac3","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d5590238-a9de-4078-843a-1a9838e5cac3","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-b"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d5590238-a9de-4078-843a-1a9838e5cac3","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"fbd47ee6-d9b1-4ab2-ac4d-27fb711488df","keyName":"e2e-revoketest-b-1","selected_subscription":"e2e-revoke-sub-b","selected_subscription_key":"models-as-a-service/e2e-revoke-sub-b@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d5590238-a9de-4078-843a-1a9838e5cac3","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d5590238-a9de-4078-843a-1a9838e5cac3","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"440dfd47-5cf0-41f6-8ae8-8732d8526d95","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:48252","PortSpecifier":{"PortValue":48252}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.32:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"440dfd47-5cf0-41f6-8ae8-8732d8526d95","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"440dfd47-5cf0-41f6-8ae8-8732d8526d95","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:48252","PortSpecifier":{"PortValue":48252}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.32:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783620900,"nanos":506932557},"http":{"id":"440dfd47-5cf0-41f6-8ae8-8732d8526d95","method":"GET","headers":{":authority":"maas.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"440dfd47-5cf0-41f6-8ae8-8732d8526d95","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1LWN15ZqIaBfFHTG4_xruZABCFoujtGhGIbraCvupJK6Lfke8OVUppzM44KOS"}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"440dfd47-5cf0-41f6-8ae8-8732d8526d95","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1LWN15ZqIaBfFHTG4_xruZABCFoujtGhGIbraCvupJK6Lfke8OVUppzM44KOS\"}"}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"440dfd47-5cf0-41f6-8ae8-8732d8526d95","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"reason":"key revoked or expired","tenant":"","valid":false}}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"440dfd47-5cf0-41f6-8ae8-8732d8526d95","input":{"auth":{"identity":"Bearer **** revoked or expired","tenant":"","valid":false}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.32:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"440dfd47-5cf0-41f6-8ae8-8732d8526d95","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access denied","request id":"440dfd47-5cf0-41f6-8ae8-8732d8526d95","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"reason":"Unauthorized"}
{"level":"info","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"440dfd47-5cf0-41f6-8ae8-8732d8526d95","authorized":false,"response":"PERMISSION_DENIED","object":{"code":7,"status":403,"message":"Unauthorized"}}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"440dfd47-5cf0-41f6-8ae8-8732d8526d95","authorized":false,"response":"PERMISSION_DENIED","object":{"code":7,"status":403,"message":"Unauthorized","headers":[{"content-type":"application/json"},{"x-ext-auth-reason":""}],"body":"{\"error\": {\"type\": \"permission_error\", \"message\": \"API key is invalid or has been revoked\"}}"}}
{"level":"info","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"dfbfc334-9a00-44f1-8152-97168f6cd901","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:48266","PortSpecifier":{"PortValue":48266}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.32:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"dfbfc334-9a00-44f1-8152-97168f6cd901","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"dfbfc334-9a00-44f1-8152-97168f6cd901","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:48266","PortSpecifier":{"PortValue":48266}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.32:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783620900,"nanos":536716354},"http":{"id":"dfbfc334-9a00-44f1-8152-97168f6cd901","method":"GET","headers":{":authority":"maas.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"dfbfc334-9a00-44f1-8152-97168f6cd901","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1o3FKk1o3XuBqS0p_6yxRZ94cSZLaLEtXQZ0lkQ27Mhjvyi4j52MYTsm0s5d"}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"dfbfc334-9a00-44f1-8152-97168f6cd901","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1o3FKk1o3XuBqS0p_6yxRZ94cSZLaLEtXQZ0lkQ27Mhjvyi4j52MYTsm0s5d\"}"}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"dfbfc334-9a00-44f1-8152-97168f6cd901","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"reason":"key revoked or expired","tenant":"","valid":false}}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"dfbfc334-9a00-44f1-8152-97168f6cd901","input":{"auth":{"identity":"Bearer **** revoked or expired","tenant":"","valid":false}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.32:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dfbfc334-9a00-44f1-8152-97168f6cd901","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access denied","request id":"dfbfc334-9a00-44f1-8152-97168f6cd901","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"reason":"Unauthorized"}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline","msg":"skipping config","request id":"dfbfc334-9a00-44f1-8152-97168f6cd901","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"reason":"context canceled"}
{"level":"info","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"dfbfc334-9a00-44f1-8152-97168f6cd901","authorized":false,"response":"PERMISSION_DENIED","object":{"code":7,"status":403,"message":"Unauthorized"}}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"dfbfc334-9a00-44f1-8152-97168f6cd901","authorized":false,"response":"PERMISSION_DENIED","object":{"code":7,"status":403,"message":"Unauthorized","headers":[{"content-type":"application/json"},{"x-ext-auth-reason":""}],"body":"{\"error\": {\"type\": \"permission_error\", \"message\": \"API key is invalid or has been revoked\"}}"}}
{"level":"info","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7464c06f-df54-49f3-9d23-5d6ce0358a19","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:48280","PortSpecifier":{"PortValue":48280}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.32:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"7464c06f-df54-49f3-9d23-5d6ce0358a19","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7464c06f-df54-49f3-9d23-5d6ce0358a19","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:48280","PortSpecifier":{"PortValue":48280}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.32:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783620900,"nanos":563320783},"http":{"id":"7464c06f-df54-49f3-9d23-5d6ce0358a19","method":"GET","headers":{":authority":"maas.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"7464c06f-df54-49f3-9d23-5d6ce0358a19","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-4YmCPtiYCBrIR6kE_C2hO76fEDXkaBtlXrVvqA4L9qPQKdOU4uFVZGKeMjWA"}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"7464c06f-df54-49f3-9d23-5d6ce0358a19","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-4YmCPtiYCBrIR6kE_C2hO76fEDXkaBtlXrVvqA4L9qPQKdOU4uFVZGKeMjWA\"}"}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"7464c06f-df54-49f3-9d23-5d6ce0358a19","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"5dc31811-6dad-4a22-ad6c-721ad9088429","keyName":"e2e-revoketest-b-0","subscription":"e2e-revoke-sub-b","tenant":"models-as-a-service","userId":"5dc31811-6dad-4a22-ad6c-721ad9088429","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"7464c06f-df54-49f3-9d23-5d6ce0358a19","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7464c06f-df54-49f3-9d23-5d6ce0358a19","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7464c06f-df54-49f3-9d23-5d6ce0358a19","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7464c06f-df54-49f3-9d23-5d6ce0358a19","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7464c06f-df54-49f3-9d23-5d6ce0358a19","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7464c06f-df54-49f3-9d23-5d6ce0358a19","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7464c06f-df54-49f3-9d23-5d6ce0358a19","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-b"}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"7464c06f-df54-49f3-9d23-5d6ce0358a19","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7464c06f-df54-49f3-9d23-5d6ce0358a19","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7464c06f-df54-49f3-9d23-5d6ce0358a19","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"36391c44-2e13-496d-bbcd-d29b25148080","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.35:58350","PortSpecifier":{"PortValue":58350}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.32:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"36391c44-2e13-496d-bbcd-d29b25148080","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"36391c44-2e13-496d-bbcd-d29b25148080","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.35:58350","PortSpecifier":{"PortValue":58350}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.32:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783620900,"nanos":575371343},"http":{"id":"36391c44-2e13-496d-bbcd-d29b25148080","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"36391c44-2e13-496d-bbcd-d29b25148080","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-4YmCPtiYCBrIR6kE_C2hO76fEDXkaBtlXrVvqA4L9qPQKdOU4uFVZGKeMjWA"}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"36391c44-2e13-496d-bbcd-d29b25148080","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-4YmCPtiYCBrIR6kE_C2hO76fEDXkaBtlXrVvqA4L9qPQKdOU4uFVZGKeMjWA\"}"}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"36391c44-2e13-496d-bbcd-d29b25148080","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"5dc31811-6dad-4a22-ad6c-721ad9088429","keyName":"e2e-revoketest-b-0","subscription":"e2e-revoke-sub-b","tenant":"models-as-a-service","userId":"5dc31811-6dad-4a22-ad6c-721ad9088429","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"36391c44-2e13-496d-bbcd-d29b25148080","config":"subscription-info","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"e2e-revoke-sub-b\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"36391c44-2e13-496d-bbcd-d29b25148080","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"36391c44-2e13-496d-bbcd-d29b25148080","input":{"auth":{"identity":"Bearer **** simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.32:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-4YmCPtiYCBrIR6kE_C2hO76fEDXkaBtlXrVvqA4L9qPQKdOU4uFVZGKeMjWA","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.132.0.35","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctcjk2Z3YKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.32~maas-default-gateway-openshift-default-56654dcf7-r96gv.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.35","x-forwarded-proto":"https","x-maas-subscription":"e2e-revoke-sub-b","x-request-id":"36391c44-2e13-496d-bbcd-d29b25148080"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"36391c44-2e13-496d-bbcd-d29b25148080","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":575371343,"seconds":1783620900},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.35:58350","port":58350}}}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"36391c44-2e13-496d-bbcd-d29b25148080","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"36391c44-2e13-496d-bbcd-d29b25148080","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"36391c44-2e13-496d-bbcd-d29b25148080","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"36391c44-2e13-496d-bbcd-d29b25148080","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"36391c44-2e13-496d-bbcd-d29b25148080","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"36391c44-2e13-496d-bbcd-d29b25148080","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"36391c44-2e13-496d-bbcd-d29b25148080","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-b"}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"36391c44-2e13-496d-bbcd-d29b25148080","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"5dc31811-6dad-4a22-ad6c-721ad9088429","keyName":"e2e-revoketest-b-0","selected_subscription":"e2e-revoke-sub-b","selected_subscription_key":"models-as-a-service/e2e-revoke-sub-b@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"36391c44-2e13-496d-bbcd-d29b25148080","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"36391c44-2e13-496d-bbcd-d29b25148080","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"abf7d910-4990-4517-ba38-60e6c7a4519f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:48282","PortSpecifier":{"PortValue":48282}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.32:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"abf7d910-4990-4517-ba38-60e6c7a4519f","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"abf7d910-4990-4517-ba38-60e6c7a4519f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:48282","PortSpecifier":{"PortValue":48282}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.32:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783620900,"nanos":612229398},"http":{"id":"abf7d910-4990-4517-ba38-60e6c7a4519f","method":"GET","headers":{":authority":"maas.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"abf7d910-4990-4517-ba38-60e6c7a4519f","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1SGy357CdCyLd9Vwd_RBWiaPaCZEVzl4ueAb0bL4AfUeOeAu7fAjmjcZJRQnH"}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"abf7d910-4990-4517-ba38-60e6c7a4519f","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1SGy357CdCyLd9Vwd_RBWiaPaCZEVzl4ueAb0bL4AfUeOeAu7fAjmjcZJRQnH\"}"}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"abf7d910-4990-4517-ba38-60e6c7a4519f","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"fbd47ee6-d9b1-4ab2-ac4d-27fb711488df","keyName":"e2e-revoketest-b-1","subscription":"e2e-revoke-sub-b","tenant":"models-as-a-service","userId":"fbd47ee6-d9b1-4ab2-ac4d-27fb711488df","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"abf7d910-4990-4517-ba38-60e6c7a4519f","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"abf7d910-4990-4517-ba38-60e6c7a4519f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"abf7d910-4990-4517-ba38-60e6c7a4519f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"abf7d910-4990-4517-ba38-60e6c7a4519f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"abf7d910-4990-4517-ba38-60e6c7a4519f","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"abf7d910-4990-4517-ba38-60e6c7a4519f","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"abf7d910-4990-4517-ba38-60e6c7a4519f","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-b"}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"abf7d910-4990-4517-ba38-60e6c7a4519f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"abf7d910-4990-4517-ba38-60e6c7a4519f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"abf7d910-4990-4517-ba38-60e6c7a4519f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ec3d02cc-0771-490d-a776-649a7f203979","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.35:58350","PortSpecifier":{"PortValue":58350}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.32:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ec3d02cc-0771-490d-a776-649a7f203979","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ec3d02cc-0771-490d-a776-649a7f203979","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.35:58350","PortSpecifier":{"PortValue":58350}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.32:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783620900,"nanos":624434328},"http":{"id":"ec3d02cc-0771-490d-a776-649a7f203979","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ec3d02cc-0771-490d-a776-649a7f203979","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1SGy357CdCyLd9Vwd_RBWiaPaCZEVzl4ueAb0bL4AfUeOeAu7fAjmjcZJRQnH"}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ec3d02cc-0771-490d-a776-649a7f203979","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1SGy357CdCyLd9Vwd_RBWiaPaCZEVzl4ueAb0bL4AfUeOeAu7fAjmjcZJRQnH\"}"}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ec3d02cc-0771-490d-a776-649a7f203979","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"fbd47ee6-d9b1-4ab2-ac4d-27fb711488df","keyName":"e2e-revoketest-b-1","subscription":"e2e-revoke-sub-b","tenant":"models-as-a-service","userId":"fbd47ee6-d9b1-4ab2-ac4d-27fb711488df","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ec3d02cc-0771-490d-a776-649a7f203979","config":"subscription-info","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"e2e-revoke-sub-b\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ec3d02cc-0771-490d-a776-649a7f203979","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ec3d02cc-0771-490d-a776-649a7f203979","input":{"auth":{"identity":"Bearer **** simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.32:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-1SGy357CdCyLd9Vwd_RBWiaPaCZEVzl4ueAb0bL4AfUeOeAu7fAjmjcZJRQnH","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.132.0.35","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctcjk2Z3YKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.32~maas-default-gateway-openshift-default-56654dcf7-r96gv.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.35","x-forwarded-proto":"https","x-maas-subscription":"e2e-revoke-sub-b","x-request-id":"ec3d02cc-0771-490d-a776-649a7f203979"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"ec3d02cc-0771-490d-a776-649a7f203979","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":624434328,"seconds":1783620900},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.35:58350","port":58350}}}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ec3d02cc-0771-490d-a776-649a7f203979","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ec3d02cc-0771-490d-a776-649a7f203979","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ec3d02cc-0771-490d-a776-649a7f203979","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ec3d02cc-0771-490d-a776-649a7f203979","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ec3d02cc-0771-490d-a776-649a7f203979","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ec3d02cc-0771-490d-a776-649a7f203979","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-b"}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ec3d02cc-0771-490d-a776-649a7f203979","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ec3d02cc-0771-490d-a776-649a7f203979","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"fbd47ee6-d9b1-4ab2-ac4d-27fb711488df","keyName":"e2e-revoketest-b-1","selected_subscription":"e2e-revoke-sub-b","selected_subscription_key":"models-as-a-service/e2e-revoke-sub-b@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ec3d02cc-0771-490d-a776-649a7f203979","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ec3d02cc-0771-490d-a776-649a7f203979","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5b65beed-e627-4875-ade2-b66cd6ba0e6e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:48284","PortSpecifier":{"PortValue":48284}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.32:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5b65beed-e627-4875-ade2-b66cd6ba0e6e","method":"DELETE","path":"/maas-api/v1/api-keys/5dc31811-6dad-4a22-ad6c-721ad9088429","host":"maas.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5b65beed-e627-4875-ade2-b66cd6ba0e6e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:48284","PortSpecifier":{"PortValue":48284}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.32:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783620900,"nanos":663344071},"http":{"id":"5b65beed-e627-4875-ade2-b66cd6ba0e6e","method":"DELETE","headers":{":authority":"maas.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/5dc31811-6dad-4a22-ad6c-721ad9088429",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"5b65beed-e627-4875-ade2-b66cd6ba0e6e","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5b65beed-e627-4875-ade2-b66cd6ba0e6e","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"8a03aca8-c185-4c8a-b6bd-33878f9e863c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=d0cd2685-b2e1-4705-9a11-a82c8e44ad44"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab31c6ab9b00"]}}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5b65beed-e627-4875-ade2-b66cd6ba0e6e","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab31c6ab9b00"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=d0cd2685-b2e1-4705-9a11-a82c8e44ad44"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"8a03aca8-c185-4c8a-b6bd-33878f9e863c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.32:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/5dc31811-6dad-4a22-ad6c-721ad9088429",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5b65beed-e627-4875-ade2-b66cd6ba0e6e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5b65beed-e627-4875-ade2-b66cd6ba0e6e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5b65beed-e627-4875-ade2-b66cd6ba0e6e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"5b65beed-e627-4875-ade2-b66cd6ba0e6e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5b65beed-e627-4875-ade2-b66cd6ba0e6e","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5b65beed-e627-4875-ade2-b66cd6ba0e6e","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5b65beed-e627-4875-ade2-b66cd6ba0e6e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5b65beed-e627-4875-ade2-b66cd6ba0e6e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7d52d7f5-6390-428b-a98a-8c4bc68db40d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:48290","PortSpecifier":{"PortValue":48290}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.32:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"7d52d7f5-6390-428b-a98a-8c4bc68db40d","method":"DELETE","path":"/maas-api/v1/api-keys/fbd47ee6-d9b1-4ab2-ac4d-27fb711488df","host":"maas.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7d52d7f5-6390-428b-a98a-8c4bc68db40d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:48290","PortSpecifier":{"PortValue":48290}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.32:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783620900,"nanos":696289458},"http":{"id":"7d52d7f5-6390-428b-a98a-8c4bc68db40d","method":"DELETE","headers":{":authority":"maas.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/fbd47ee6-d9b1-4ab2-ac4d-27fb711488df",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"7d52d7f5-6390-428b-a98a-8c4bc68db40d","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"7d52d7f5-6390-428b-a98a-8c4bc68db40d","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"8a03aca8-c185-4c8a-b6bd-33878f9e863c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=d0cd2685-b2e1-4705-9a11-a82c8e44ad44"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab31c6ab9b00"]}}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"7d52d7f5-6390-428b-a98a-8c4bc68db40d","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab31c6ab9b00"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=d0cd2685-b2e1-4705-9a11-a82c8e44ad44"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"8a03aca8-c185-4c8a-b6bd-33878f9e863c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.32:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/fbd47ee6-d9b1-4ab2-ac4d-27fb711488df",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7d52d7f5-6390-428b-a98a-8c4bc68db40d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7d52d7f5-6390-428b-a98a-8c4bc68db40d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7d52d7f5-6390-428b-a98a-8c4bc68db40d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"7d52d7f5-6390-428b-a98a-8c4bc68db40d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7d52d7f5-6390-428b-a98a-8c4bc68db40d","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7d52d7f5-6390-428b-a98a-8c4bc68db40d","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7d52d7f5-6390-428b-a98a-8c4bc68db40d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7d52d7f5-6390-428b-a98a-8c4bc68db40d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T18:15:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3455d8f8a1e11fba85909b8231717c92033ad1c6a916ad9ced0ad92b6291b67c"}
{"level":"info","ts":"2026-07-09T18:15:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/8faf4c28b604919a04688c9d0b71f043cb8e28cc00b2ed987389e5b81eb3b7b5"}
{"level":"info","ts":"2026-07-09T18:15:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ddff7ede1f151ef30e3f545ea4b684ed64ab790bace80fb118471e204787c69c"}
{"level":"info","ts":"2026-07-09T18:15:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/328ac1cd7fa902c7251c9136cce18d5edaf6548fd739c05b51324ea9c56c169e"}
{"level":"info","ts":"2026-07-09T18:15:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9022bf871584c1ee8e545b8083a1b2050a98b04db4f75e1d571054cf14324e3f"}
{"level":"info","ts":"2026-07-09T18:15:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ee6545a443da010e397446e5aea8407d7494c0bf8df9dfd263e5d11d03b99e7e"}
{"level":"info","ts":"2026-07-09T18:15:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/52207e8808a5af400ac23bdc55d7ab4dfa8777350b1e22159ca72575a356c947"}
{"level":"info","ts":"2026-07-09T18:15:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ccfc7249f981cee0416a0e386cba8cdba0b3cf266e9e99878df6be42ce87f9d8"}
{"level":"info","ts":"2026-07-09T18:15:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/64782d5b5dc52a650fc17c002109a570a7536b812428118134f5d7689a628373"}
{"level":"info","ts":"2026-07-09T18:15:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/858e15e1a7184d729f8a1f69fcfd3b082b5fa0a39b96378ef7ff02e147dfce8c"}
{"level":"info","ts":"2026-07-09T18:15:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3551875117ccf3984c27a02b4864f4cd1c57e8ac94e5723b572e4ebbb2bcda9f"}
{"level":"info","ts":"2026-07-09T18:15:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7fbac276220634445d8f6817b6d43203fb85387d7cb81c1c8e2d907b2dfcaaac"}
{"level":"info","ts":"2026-07-09T18:15:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/612e4d6571f54392dc4bb1845f7d87f335994587f999a2d7f8cd344aeaf1d36f"}
{"level":"info","ts":"2026-07-09T18:15:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/02872928c34520c992744c56cd2a8decc2c72faa0371a3cf66a4596769899cd6"}
{"level":"info","ts":"2026-07-09T18:15:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4497f2636ed35517f7996014ddb76e47743246fa17c97278f7a75525a38f8f32"}
{"level":"info","ts":"2026-07-09T18:15:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d2c73e6df73ec2c6b7e8bcee8aeaa086e6784eb2f32fcdd5956c8c7a26a9f91f"}
{"level":"info","ts":"2026-07-09T18:15:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6fff71fcd45a294412257cdd7721672479b46bddf883bead293812798aca2799"}
{"level":"info","ts":"2026-07-09T18:15:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/da41b07f92d255d3238b29ad30df8c0ee8a4fe5642aa41d9956e7ed89f5cb3bc"}
{"level":"info","ts":"2026-07-09T18:15:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9b729fee5f198546b25447d43f6aac3c5d2da0ab25e3729b865bc3257e29673a"}
{"level":"info","ts":"2026-07-09T18:15:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d0dc982a4b2bb71b26b48cdc76131f83b5c5ef6691a5682c984d9c772913a6de"}
{"level":"info","ts":"2026-07-09T18:15:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3682972e0c81bfc88ef826fc0824c34a3a6f73b8888ffa4426c86a341dd9b2cc"}
{"level":"info","ts":"2026-07-09T18:15:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d8e0850808cc3464b9bc0513c8149e79e80d6d1342e3ad0fcb38a541c9d49a0d"}
{"level":"info","ts":"2026-07-09T18:15:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d9bdad4f2209ade368fb8e3e9899aed674691a49f320a4c7056f5befc66c4d25"}
{"level":"info","ts":"2026-07-09T18:15:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3b3177991297fdbae2c007ceba4a843cc4cee6ffb746764254c1b3c63519840e"}