{"level":"info","ts":"2026-07-09T18:14:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7b02eab8-778f-43ff-b749-5f81a7242861","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:60378","PortSpecifier":{"PortValue":60378}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"7b02eab8-778f-43ff-b749-5f81a7242861","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-09d279.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T18:14:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7b02eab8-778f-43ff-b749-5f81a7242861","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:60378","PortSpecifier":{"PortValue":60378}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783620873,"nanos":216467154},"http":{"id":"7b02eab8-778f-43ff-b749-5f81a7242861","method":"POST","headers":{":authority":"e2e-shared-a-09d279.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:14:33Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"7b02eab8-778f-43ff-b749-5f81a7242861","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T18:14:33Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"7b02eab8-778f-43ff-b749-5f81a7242861","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"8a03aca8-c185-4c8a-b6bd-33878f9e863c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=d0cd2685-b2e1-4705-9a11-a82c8e44ad44"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab31c6ab9b00"]}}
{"level":"debug","ts":"2026-07-09T18:14:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"7b02eab8-778f-43ff-b749-5f81a7242861","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab31c6ab9b00"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=d0cd2685-b2e1-4705-9a11-a82c8e44ad44"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"8a03aca8-c185-4c8a-b6bd-33878f9e863c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"6fff71fcd45a294412257cdd7721672479b46bddf883bead293812798aca2799"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.47:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-09d279.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:14:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7b02eab8-778f-43ff-b749-5f81a7242861","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7b02eab8-778f-43ff-b749-5f81a7242861","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7b02eab8-778f-43ff-b749-5f81a7242861","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-09d279/rate-test-model-09d279\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"7b02eab8-778f-43ff-b749-5f81a7242861","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T18:14:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7b02eab8-778f-43ff-b749-5f81a7242861","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T18:14:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7b02eab8-778f-43ff-b749-5f81a7242861","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-09T18:14:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7b02eab8-778f-43ff-b749-5f81a7242861","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T18:14:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7b02eab8-778f-43ff-b749-5f81a7242861","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T18:14:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"703af138-26c9-47a8-a90e-1e02387d9fa6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:42678","PortSpecifier":{"PortValue":42678}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"703af138-26c9-47a8-a90e-1e02387d9fa6","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-e0b9f9.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T18:14:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"703af138-26c9-47a8-a90e-1e02387d9fa6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:42678","PortSpecifier":{"PortValue":42678}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783620873,"nanos":259671745},"http":{"id":"703af138-26c9-47a8-a90e-1e02387d9fa6","method":"POST","headers":{":authority":"e2e-shared-b-e0b9f9.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:14:33Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"703af138-26c9-47a8-a90e-1e02387d9fa6","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T18:14:33Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"703af138-26c9-47a8-a90e-1e02387d9fa6","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"8a03aca8-c185-4c8a-b6bd-33878f9e863c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=d0cd2685-b2e1-4705-9a11-a82c8e44ad44"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab31c6ab9b00"]}}
{"level":"debug","ts":"2026-07-09T18:14:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"703af138-26c9-47a8-a90e-1e02387d9fa6","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab31c6ab9b00"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=d0cd2685-b2e1-4705-9a11-a82c8e44ad44"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"8a03aca8-c185-4c8a-b6bd-33878f9e863c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"3682972e0c81bfc88ef826fc0824c34a3a6f73b8888ffa4426c86a341dd9b2cc"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.48:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-e0b9f9.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:14:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"703af138-26c9-47a8-a90e-1e02387d9fa6","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"703af138-26c9-47a8-a90e-1e02387d9fa6","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"703af138-26c9-47a8-a90e-1e02387d9fa6","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-e0b9f9/rate-test-model-e0b9f9\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"703af138-26c9-47a8-a90e-1e02387d9fa6","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T18:14:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"703af138-26c9-47a8-a90e-1e02387d9fa6","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T18:14:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"703af138-26c9-47a8-a90e-1e02387d9fa6","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T18:14:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"703af138-26c9-47a8-a90e-1e02387d9fa6","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T18:14:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"703af138-26c9-47a8-a90e-1e02387d9fa6","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T18:14:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3b05718a-355b-47be-a766-2f0102f3a9d2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:60394","PortSpecifier":{"PortValue":60394}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3b05718a-355b-47be-a766-2f0102f3a9d2","method":"POST","path":"/ai-tenant-e2e-shared-a-09d279/rate-test-model-09d279/v1/completions","host":"e2e-shared-a-09d279.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T18:14:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3b05718a-355b-47be-a766-2f0102f3a9d2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:60394","PortSpecifier":{"PortValue":60394}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783620873,"nanos":300137343},"http":{"id":"3b05718a-355b-47be-a766-2f0102f3a9d2","method":"POST","headers":{":authority":"e2e-shared-a-09d279.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-09d279/rate-test-model-09d279/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:14:33Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3b05718a-355b-47be-a766-2f0102f3a9d2","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1PxzonwpH86SUaqow_Y7CrXW6Bdl1InJA48k8tA7fH8rD7Ho4Z7Ih03NxWzq6"}
{"level":"debug","ts":"2026-07-09T18:14:33Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3b05718a-355b-47be-a766-2f0102f3a9d2","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-09d279.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1PxzonwpH86SUaqow_Y7CrXW6Bdl1InJA48k8tA7fH8rD7Ho4Z7Ih03NxWzq6\"}"}
{"level":"debug","ts":"2026-07-09T18:14:33Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3b05718a-355b-47be-a766-2f0102f3a9d2","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-09d279.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"30b23380-1b43-43ca-91d1-6f19a5186e63","keyName":"e2e-rate-a-b6ad11","subscription":"e2e-rate-iso-a-b6ad11","tenant":"e2e-shared-a-09d279","userId":"30b23380-1b43-43ca-91d1-6f19a5186e63","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T18:14:33Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3b05718a-355b-47be-a766-2f0102f3a9d2","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-09d279.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-09d279/rate-test-model-09d279\",\"requestedSubscription\":\"e2e-rate-iso-a-b6ad11\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T18:14:33Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3b05718a-355b-47be-a766-2f0102f3a9d2","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-09d279.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-09d279","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-b6ad11","namespace":"ai-tenant-e2e-shared-a-09d279","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T18:14:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3b05718a-355b-47be-a766-2f0102f3a9d2","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:14:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3b05718a-355b-47be-a766-2f0102f3a9d2","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3b05718a-355b-47be-a766-2f0102f3a9d2","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3b05718a-355b-47be-a766-2f0102f3a9d2","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-09d279/rate-test-model-09d279\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3b05718a-355b-47be-a766-2f0102f3a9d2","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3b05718a-355b-47be-a766-2f0102f3a9d2","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T18:14:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3b05718a-355b-47be-a766-2f0102f3a9d2","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T18:14:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3b05718a-355b-47be-a766-2f0102f3a9d2","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-b6ad11"}
{"level":"debug","ts":"2026-07-09T18:14:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3b05718a-355b-47be-a766-2f0102f3a9d2","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"30b23380-1b43-43ca-91d1-6f19a5186e63","keyName":"e2e-rate-a-b6ad11","selected_subscription":"e2e-rate-iso-a-b6ad11","selected_subscription_key":"ai-tenant-e2e-shared-a-09d279/e2e-rate-iso-a-b6ad11@ai-tenant-e2e-shared-a-09d279/rate-test-model-09d279","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-09d279","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-b6ad11","namespace":"ai-tenant-e2e-shared-a-09d279","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T18:14:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3b05718a-355b-47be-a766-2f0102f3a9d2","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T18:14:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3b05718a-355b-47be-a766-2f0102f3a9d2","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T18:14:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"42a74be0-8004-4735-8b0b-509db86e6789","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:60410","PortSpecifier":{"PortValue":60410}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"42a74be0-8004-4735-8b0b-509db86e6789","method":"POST","path":"/ai-tenant-e2e-shared-a-09d279/rate-test-model-09d279/v1/completions","host":"e2e-shared-a-09d279.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T18:14:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"42a74be0-8004-4735-8b0b-509db86e6789","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:60410","PortSpecifier":{"PortValue":60410}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783620874,"nanos":360713480},"http":{"id":"42a74be0-8004-4735-8b0b-509db86e6789","method":"POST","headers":{":authority":"e2e-shared-a-09d279.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-09d279/rate-test-model-09d279/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:14:34Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"42a74be0-8004-4735-8b0b-509db86e6789","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1PxzonwpH86SUaqow_Y7CrXW6Bdl1InJA48k8tA7fH8rD7Ho4Z7Ih03NxWzq6"}
{"level":"debug","ts":"2026-07-09T18:14:34Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"42a74be0-8004-4735-8b0b-509db86e6789","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-09d279.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1PxzonwpH86SUaqow_Y7CrXW6Bdl1InJA48k8tA7fH8rD7Ho4Z7Ih03NxWzq6\"}"}
{"level":"debug","ts":"2026-07-09T18:14:34Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"42a74be0-8004-4735-8b0b-509db86e6789","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-09d279.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"30b23380-1b43-43ca-91d1-6f19a5186e63","keyName":"e2e-rate-a-b6ad11","subscription":"e2e-rate-iso-a-b6ad11","tenant":"e2e-shared-a-09d279","userId":"30b23380-1b43-43ca-91d1-6f19a5186e63","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T18:14:34Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"42a74be0-8004-4735-8b0b-509db86e6789","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-09d279.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-09d279/rate-test-model-09d279\",\"requestedSubscription\":\"e2e-rate-iso-a-b6ad11\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T18:14:34Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"42a74be0-8004-4735-8b0b-509db86e6789","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-09d279.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-09d279","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-b6ad11","namespace":"ai-tenant-e2e-shared-a-09d279","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T18:14:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"42a74be0-8004-4735-8b0b-509db86e6789","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:14:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"42a74be0-8004-4735-8b0b-509db86e6789","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"42a74be0-8004-4735-8b0b-509db86e6789","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"42a74be0-8004-4735-8b0b-509db86e6789","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-09d279/rate-test-model-09d279\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"42a74be0-8004-4735-8b0b-509db86e6789","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"42a74be0-8004-4735-8b0b-509db86e6789","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T18:14:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"42a74be0-8004-4735-8b0b-509db86e6789","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-b6ad11"}
{"level":"debug","ts":"2026-07-09T18:14:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"42a74be0-8004-4735-8b0b-509db86e6789","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T18:14:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"42a74be0-8004-4735-8b0b-509db86e6789","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"30b23380-1b43-43ca-91d1-6f19a5186e63","keyName":"e2e-rate-a-b6ad11","selected_subscription":"e2e-rate-iso-a-b6ad11","selected_subscription_key":"ai-tenant-e2e-shared-a-09d279/e2e-rate-iso-a-b6ad11@ai-tenant-e2e-shared-a-09d279/rate-test-model-09d279","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-09d279","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-b6ad11","namespace":"ai-tenant-e2e-shared-a-09d279","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T18:14:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"42a74be0-8004-4735-8b0b-509db86e6789","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T18:14:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"42a74be0-8004-4735-8b0b-509db86e6789","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T18:14:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6deaa62f-c248-4f83-a7c2-a111a8ab7222","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:60426","PortSpecifier":{"PortValue":60426}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6deaa62f-c248-4f83-a7c2-a111a8ab7222","method":"POST","path":"/ai-tenant-e2e-shared-a-09d279/rate-test-model-09d279/v1/completions","host":"e2e-shared-a-09d279.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T18:14:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6deaa62f-c248-4f83-a7c2-a111a8ab7222","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:60426","PortSpecifier":{"PortValue":60426}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783620875,"nanos":397257023},"http":{"id":"6deaa62f-c248-4f83-a7c2-a111a8ab7222","method":"POST","headers":{":authority":"e2e-shared-a-09d279.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-09d279/rate-test-model-09d279/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:14:35Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6deaa62f-c248-4f83-a7c2-a111a8ab7222","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1PxzonwpH86SUaqow_Y7CrXW6Bdl1InJA48k8tA7fH8rD7Ho4Z7Ih03NxWzq6"}
{"level":"debug","ts":"2026-07-09T18:14:35Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6deaa62f-c248-4f83-a7c2-a111a8ab7222","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-09d279.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1PxzonwpH86SUaqow_Y7CrXW6Bdl1InJA48k8tA7fH8rD7Ho4Z7Ih03NxWzq6\"}"}
{"level":"debug","ts":"2026-07-09T18:14:35Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6deaa62f-c248-4f83-a7c2-a111a8ab7222","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-09d279.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"30b23380-1b43-43ca-91d1-6f19a5186e63","keyName":"e2e-rate-a-b6ad11","subscription":"e2e-rate-iso-a-b6ad11","tenant":"e2e-shared-a-09d279","userId":"30b23380-1b43-43ca-91d1-6f19a5186e63","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T18:14:35Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6deaa62f-c248-4f83-a7c2-a111a8ab7222","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-09d279.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-09d279/rate-test-model-09d279\",\"requestedSubscription\":\"e2e-rate-iso-a-b6ad11\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T18:14:35Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6deaa62f-c248-4f83-a7c2-a111a8ab7222","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-09d279.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-09d279","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-b6ad11","namespace":"ai-tenant-e2e-shared-a-09d279","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T18:14:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6deaa62f-c248-4f83-a7c2-a111a8ab7222","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:14:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6deaa62f-c248-4f83-a7c2-a111a8ab7222","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6deaa62f-c248-4f83-a7c2-a111a8ab7222","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6deaa62f-c248-4f83-a7c2-a111a8ab7222","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6deaa62f-c248-4f83-a7c2-a111a8ab7222","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-09d279/rate-test-model-09d279\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6deaa62f-c248-4f83-a7c2-a111a8ab7222","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T18:14:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6deaa62f-c248-4f83-a7c2-a111a8ab7222","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-b6ad11"}
{"level":"debug","ts":"2026-07-09T18:14:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6deaa62f-c248-4f83-a7c2-a111a8ab7222","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T18:14:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6deaa62f-c248-4f83-a7c2-a111a8ab7222","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"30b23380-1b43-43ca-91d1-6f19a5186e63","keyName":"e2e-rate-a-b6ad11","selected_subscription":"e2e-rate-iso-a-b6ad11","selected_subscription_key":"ai-tenant-e2e-shared-a-09d279/e2e-rate-iso-a-b6ad11@ai-tenant-e2e-shared-a-09d279/rate-test-model-09d279","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-09d279","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-b6ad11","namespace":"ai-tenant-e2e-shared-a-09d279","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T18:14:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6deaa62f-c248-4f83-a7c2-a111a8ab7222","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T18:14:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6deaa62f-c248-4f83-a7c2-a111a8ab7222","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T18:14:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6567db8c-eb89-4ade-8d04-11dc1a776341","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:55218","PortSpecifier":{"PortValue":55218}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6567db8c-eb89-4ade-8d04-11dc1a776341","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-09d279.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T18:14:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6567db8c-eb89-4ade-8d04-11dc1a776341","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:55218","PortSpecifier":{"PortValue":55218}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783620886,"nanos":254271678},"http":{"id":"6567db8c-eb89-4ade-8d04-11dc1a776341","method":"POST","headers":{":authority":"e2e-shared-a-09d279.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:14:46Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"6567db8c-eb89-4ade-8d04-11dc1a776341","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T18:14:46Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6567db8c-eb89-4ade-8d04-11dc1a776341","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"8a03aca8-c185-4c8a-b6bd-33878f9e863c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=d0cd2685-b2e1-4705-9a11-a82c8e44ad44"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab31c6ab9b00"]}}
{"level":"debug","ts":"2026-07-09T18:14:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6567db8c-eb89-4ade-8d04-11dc1a776341","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab31c6ab9b00"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=d0cd2685-b2e1-4705-9a11-a82c8e44ad44"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"8a03aca8-c185-4c8a-b6bd-33878f9e863c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"6fff71fcd45a294412257cdd7721672479b46bddf883bead293812798aca2799"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.47:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-09d279.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:14:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6567db8c-eb89-4ade-8d04-11dc1a776341","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6567db8c-eb89-4ade-8d04-11dc1a776341","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6567db8c-eb89-4ade-8d04-11dc1a776341","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-09d279/rate-test-model-09d279\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"6567db8c-eb89-4ade-8d04-11dc1a776341","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T18:14:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6567db8c-eb89-4ade-8d04-11dc1a776341","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T18:14:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6567db8c-eb89-4ade-8d04-11dc1a776341","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-09T18:14:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6567db8c-eb89-4ade-8d04-11dc1a776341","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T18:14:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6567db8c-eb89-4ade-8d04-11dc1a776341","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T18:14:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2afae651-0c32-4650-a594-adb0394650f9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:34302","PortSpecifier":{"PortValue":34302}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2afae651-0c32-4650-a594-adb0394650f9","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-e0b9f9.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T18:14:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2afae651-0c32-4650-a594-adb0394650f9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:34302","PortSpecifier":{"PortValue":34302}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783620886,"nanos":289515372},"http":{"id":"2afae651-0c32-4650-a594-adb0394650f9","method":"POST","headers":{":authority":"e2e-shared-b-e0b9f9.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:14:46Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"2afae651-0c32-4650-a594-adb0394650f9","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T18:14:46Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2afae651-0c32-4650-a594-adb0394650f9","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"8a03aca8-c185-4c8a-b6bd-33878f9e863c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=d0cd2685-b2e1-4705-9a11-a82c8e44ad44"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab31c6ab9b00"]}}
{"level":"debug","ts":"2026-07-09T18:14:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2afae651-0c32-4650-a594-adb0394650f9","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab31c6ab9b00"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=d0cd2685-b2e1-4705-9a11-a82c8e44ad44"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"8a03aca8-c185-4c8a-b6bd-33878f9e863c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"3682972e0c81bfc88ef826fc0824c34a3a6f73b8888ffa4426c86a341dd9b2cc"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.48:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-e0b9f9.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:14:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2afae651-0c32-4650-a594-adb0394650f9","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2afae651-0c32-4650-a594-adb0394650f9","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2afae651-0c32-4650-a594-adb0394650f9","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-e0b9f9/rate-test-model-e0b9f9\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"2afae651-0c32-4650-a594-adb0394650f9","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T18:14:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2afae651-0c32-4650-a594-adb0394650f9","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T18:14:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2afae651-0c32-4650-a594-adb0394650f9","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-09T18:14:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2afae651-0c32-4650-a594-adb0394650f9","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T18:14:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2afae651-0c32-4650-a594-adb0394650f9","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T18:14:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f55e712c-bb56-49f1-b31e-91c723208793","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:55224","PortSpecifier":{"PortValue":55224}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f55e712c-bb56-49f1-b31e-91c723208793","method":"POST","path":"/ai-tenant-e2e-shared-a-09d279/rate-test-model-09d279/v1/completions","host":"e2e-shared-a-09d279.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T18:14:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f55e712c-bb56-49f1-b31e-91c723208793","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:55224","PortSpecifier":{"PortValue":55224}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783620886,"nanos":329030995},"http":{"id":"f55e712c-bb56-49f1-b31e-91c723208793","method":"POST","headers":{":authority":"e2e-shared-a-09d279.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-09d279/rate-test-model-09d279/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:14:46Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f55e712c-bb56-49f1-b31e-91c723208793","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-cjgJDF9SqNZd9sgP_ZEWDjrwk3Sov0vBKnM3euLnwCwRr7Zo4MPLtUghPdWm"}
{"level":"debug","ts":"2026-07-09T18:14:46Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f55e712c-bb56-49f1-b31e-91c723208793","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-09d279.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-cjgJDF9SqNZd9sgP_ZEWDjrwk3Sov0vBKnM3euLnwCwRr7Zo4MPLtUghPdWm\"}"}
{"level":"debug","ts":"2026-07-09T18:14:46Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f55e712c-bb56-49f1-b31e-91c723208793","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-09d279.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"c1d040b8-c166-4f32-b292-dc6ec799b49f","keyName":"e2e-rate-a-96f763","subscription":"e2e-rate-iso-a-96f763","tenant":"e2e-shared-a-09d279","userId":"c1d040b8-c166-4f32-b292-dc6ec799b49f","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T18:14:46Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f55e712c-bb56-49f1-b31e-91c723208793","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-09d279.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-09d279/rate-test-model-09d279\",\"requestedSubscription\":\"e2e-rate-iso-a-96f763\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T18:14:46Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f55e712c-bb56-49f1-b31e-91c723208793","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-09d279.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-09d279","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-96f763","namespace":"ai-tenant-e2e-shared-a-09d279","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T18:14:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f55e712c-bb56-49f1-b31e-91c723208793","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:14:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f55e712c-bb56-49f1-b31e-91c723208793","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f55e712c-bb56-49f1-b31e-91c723208793","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f55e712c-bb56-49f1-b31e-91c723208793","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-09d279/rate-test-model-09d279\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f55e712c-bb56-49f1-b31e-91c723208793","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f55e712c-bb56-49f1-b31e-91c723208793","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T18:14:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f55e712c-bb56-49f1-b31e-91c723208793","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-96f763"}
{"level":"debug","ts":"2026-07-09T18:14:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f55e712c-bb56-49f1-b31e-91c723208793","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T18:14:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f55e712c-bb56-49f1-b31e-91c723208793","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"c1d040b8-c166-4f32-b292-dc6ec799b49f","keyName":"e2e-rate-a-96f763","selected_subscription":"e2e-rate-iso-a-96f763","selected_subscription_key":"ai-tenant-e2e-shared-a-09d279/e2e-rate-iso-a-96f763@ai-tenant-e2e-shared-a-09d279/rate-test-model-09d279","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-09d279","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-96f763","namespace":"ai-tenant-e2e-shared-a-09d279","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T18:14:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f55e712c-bb56-49f1-b31e-91c723208793","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T18:14:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f55e712c-bb56-49f1-b31e-91c723208793","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T18:14:47Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5e84eb68-c31e-4970-9789-09d2cedf21e8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:39984","PortSpecifier":{"PortValue":39984}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5e84eb68-c31e-4970-9789-09d2cedf21e8","method":"POST","path":"/ai-tenant-e2e-shared-a-09d279/rate-test-model-09d279/v1/completions","host":"e2e-shared-a-09d279.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T18:14:47Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5e84eb68-c31e-4970-9789-09d2cedf21e8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:39984","PortSpecifier":{"PortValue":39984}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783620887,"nanos":366807184},"http":{"id":"5e84eb68-c31e-4970-9789-09d2cedf21e8","method":"POST","headers":{":authority":"e2e-shared-a-09d279.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-09d279/rate-test-model-09d279/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:14:47Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5e84eb68-c31e-4970-9789-09d2cedf21e8","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-cjgJDF9SqNZd9sgP_ZEWDjrwk3Sov0vBKnM3euLnwCwRr7Zo4MPLtUghPdWm"}
{"level":"debug","ts":"2026-07-09T18:14:47Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5e84eb68-c31e-4970-9789-09d2cedf21e8","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-09d279.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-cjgJDF9SqNZd9sgP_ZEWDjrwk3Sov0vBKnM3euLnwCwRr7Zo4MPLtUghPdWm\"}"}
{"level":"debug","ts":"2026-07-09T18:14:47Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5e84eb68-c31e-4970-9789-09d2cedf21e8","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-09d279.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"c1d040b8-c166-4f32-b292-dc6ec799b49f","keyName":"e2e-rate-a-96f763","subscription":"e2e-rate-iso-a-96f763","tenant":"e2e-shared-a-09d279","userId":"c1d040b8-c166-4f32-b292-dc6ec799b49f","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T18:14:47Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5e84eb68-c31e-4970-9789-09d2cedf21e8","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-09d279.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-09d279/rate-test-model-09d279\",\"requestedSubscription\":\"e2e-rate-iso-a-96f763\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T18:14:47Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5e84eb68-c31e-4970-9789-09d2cedf21e8","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-09d279.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-09d279","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-96f763","namespace":"ai-tenant-e2e-shared-a-09d279","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T18:14:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5e84eb68-c31e-4970-9789-09d2cedf21e8","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:14:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5e84eb68-c31e-4970-9789-09d2cedf21e8","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5e84eb68-c31e-4970-9789-09d2cedf21e8","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5e84eb68-c31e-4970-9789-09d2cedf21e8","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-09d279/rate-test-model-09d279\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5e84eb68-c31e-4970-9789-09d2cedf21e8","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5e84eb68-c31e-4970-9789-09d2cedf21e8","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T18:14:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5e84eb68-c31e-4970-9789-09d2cedf21e8","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-96f763"}
{"level":"debug","ts":"2026-07-09T18:14:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5e84eb68-c31e-4970-9789-09d2cedf21e8","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T18:14:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5e84eb68-c31e-4970-9789-09d2cedf21e8","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"c1d040b8-c166-4f32-b292-dc6ec799b49f","keyName":"e2e-rate-a-96f763","selected_subscription":"e2e-rate-iso-a-96f763","selected_subscription_key":"ai-tenant-e2e-shared-a-09d279/e2e-rate-iso-a-96f763@ai-tenant-e2e-shared-a-09d279/rate-test-model-09d279","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-09d279","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-96f763","namespace":"ai-tenant-e2e-shared-a-09d279","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T18:14:47Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5e84eb68-c31e-4970-9789-09d2cedf21e8","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T18:14:47Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5e84eb68-c31e-4970-9789-09d2cedf21e8","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T18:14:48Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f5f24806-8a49-4566-99c7-2b28cf7532b0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:39986","PortSpecifier":{"PortValue":39986}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f5f24806-8a49-4566-99c7-2b28cf7532b0","method":"POST","path":"/ai-tenant-e2e-shared-a-09d279/rate-test-model-09d279/v1/completions","host":"e2e-shared-a-09d279.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T18:14:48Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f5f24806-8a49-4566-99c7-2b28cf7532b0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:39986","PortSpecifier":{"PortValue":39986}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783620888,"nanos":401492558},"http":{"id":"f5f24806-8a49-4566-99c7-2b28cf7532b0","method":"POST","headers":{":authority":"e2e-shared-a-09d279.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-09d279/rate-test-model-09d279/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:14:48Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f5f24806-8a49-4566-99c7-2b28cf7532b0","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-cjgJDF9SqNZd9sgP_ZEWDjrwk3Sov0vBKnM3euLnwCwRr7Zo4MPLtUghPdWm"}
{"level":"debug","ts":"2026-07-09T18:14:48Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f5f24806-8a49-4566-99c7-2b28cf7532b0","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-09d279.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-cjgJDF9SqNZd9sgP_ZEWDjrwk3Sov0vBKnM3euLnwCwRr7Zo4MPLtUghPdWm\"}"}
{"level":"debug","ts":"2026-07-09T18:14:48Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f5f24806-8a49-4566-99c7-2b28cf7532b0","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-09d279.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"c1d040b8-c166-4f32-b292-dc6ec799b49f","keyName":"e2e-rate-a-96f763","subscription":"e2e-rate-iso-a-96f763","tenant":"e2e-shared-a-09d279","userId":"c1d040b8-c166-4f32-b292-dc6ec799b49f","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T18:14:48Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f5f24806-8a49-4566-99c7-2b28cf7532b0","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-09d279.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-09d279/rate-test-model-09d279\",\"requestedSubscription\":\"e2e-rate-iso-a-96f763\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T18:14:48Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f5f24806-8a49-4566-99c7-2b28cf7532b0","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-09d279.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-09d279","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-96f763","namespace":"ai-tenant-e2e-shared-a-09d279","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T18:14:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f5f24806-8a49-4566-99c7-2b28cf7532b0","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:14:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f5f24806-8a49-4566-99c7-2b28cf7532b0","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f5f24806-8a49-4566-99c7-2b28cf7532b0","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f5f24806-8a49-4566-99c7-2b28cf7532b0","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-09d279/rate-test-model-09d279\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f5f24806-8a49-4566-99c7-2b28cf7532b0","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f5f24806-8a49-4566-99c7-2b28cf7532b0","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T18:14:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f5f24806-8a49-4566-99c7-2b28cf7532b0","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-96f763"}
{"level":"debug","ts":"2026-07-09T18:14:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f5f24806-8a49-4566-99c7-2b28cf7532b0","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T18:14:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f5f24806-8a49-4566-99c7-2b28cf7532b0","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"c1d040b8-c166-4f32-b292-dc6ec799b49f","keyName":"e2e-rate-a-96f763","selected_subscription":"e2e-rate-iso-a-96f763","selected_subscription_key":"ai-tenant-e2e-shared-a-09d279/e2e-rate-iso-a-96f763@ai-tenant-e2e-shared-a-09d279/rate-test-model-09d279","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-09d279","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-96f763","namespace":"ai-tenant-e2e-shared-a-09d279","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T18:14:48Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f5f24806-8a49-4566-99c7-2b28cf7532b0","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T18:14:48Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f5f24806-8a49-4566-99c7-2b28cf7532b0","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T18:14:48Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2f791be6-d8e3-431b-833e-38a3bdcbe388","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:36406","PortSpecifier":{"PortValue":36406}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2f791be6-d8e3-431b-833e-38a3bdcbe388","method":"POST","path":"/ai-tenant-e2e-shared-b-e0b9f9/rate-test-model-e0b9f9/v1/completions","host":"e2e-shared-b-e0b9f9.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T18:14:48Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2f791be6-d8e3-431b-833e-38a3bdcbe388","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:36406","PortSpecifier":{"PortValue":36406}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783620888,"nanos":436446169},"http":{"id":"2f791be6-d8e3-431b-833e-38a3bdcbe388","method":"POST","headers":{":authority":"e2e-shared-b-e0b9f9.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-e0b9f9/rate-test-model-e0b9f9/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:14:48Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2f791be6-d8e3-431b-833e-38a3bdcbe388","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-11UK6VswEcrg0qyZ2_rgs4OFRNNWKXqPoH8KcS5WRfpTaB1zKJq9ikb5p7HiX"}
{"level":"debug","ts":"2026-07-09T18:14:48Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2f791be6-d8e3-431b-833e-38a3bdcbe388","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-e0b9f9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-11UK6VswEcrg0qyZ2_rgs4OFRNNWKXqPoH8KcS5WRfpTaB1zKJq9ikb5p7HiX\"}"}
{"level":"debug","ts":"2026-07-09T18:14:48Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2f791be6-d8e3-431b-833e-38a3bdcbe388","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-e0b9f9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"f740e289-c586-4e96-aa1e-15c1e922165b","keyName":"e2e-rate-b-96f763","subscription":"e2e-rate-iso-b-96f763","tenant":"e2e-shared-b-e0b9f9","userId":"f740e289-c586-4e96-aa1e-15c1e922165b","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T18:14:48Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2f791be6-d8e3-431b-833e-38a3bdcbe388","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-e0b9f9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-e0b9f9/rate-test-model-e0b9f9\",\"requestedSubscription\":\"e2e-rate-iso-b-96f763\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T18:14:48Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2f791be6-d8e3-431b-833e-38a3bdcbe388","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-e0b9f9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-e0b9f9","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-96f763","namespace":"ai-tenant-e2e-shared-b-e0b9f9","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T18:14:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2f791be6-d8e3-431b-833e-38a3bdcbe388","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:14:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2f791be6-d8e3-431b-833e-38a3bdcbe388","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2f791be6-d8e3-431b-833e-38a3bdcbe388","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2f791be6-d8e3-431b-833e-38a3bdcbe388","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-e0b9f9/rate-test-model-e0b9f9\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2f791be6-d8e3-431b-833e-38a3bdcbe388","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2f791be6-d8e3-431b-833e-38a3bdcbe388","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-96f763"}
{"level":"debug","ts":"2026-07-09T18:14:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2f791be6-d8e3-431b-833e-38a3bdcbe388","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T18:14:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2f791be6-d8e3-431b-833e-38a3bdcbe388","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T18:14:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2f791be6-d8e3-431b-833e-38a3bdcbe388","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"f740e289-c586-4e96-aa1e-15c1e922165b","keyName":"e2e-rate-b-96f763","selected_subscription":"e2e-rate-iso-b-96f763","selected_subscription_key":"ai-tenant-e2e-shared-b-e0b9f9/e2e-rate-iso-b-96f763@ai-tenant-e2e-shared-b-e0b9f9/rate-test-model-e0b9f9","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-e0b9f9","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-96f763","namespace":"ai-tenant-e2e-shared-b-e0b9f9","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T18:14:48Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2f791be6-d8e3-431b-833e-38a3bdcbe388","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T18:14:48Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2f791be6-d8e3-431b-833e-38a3bdcbe388","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T18:14:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"60f14a4b-5012-4256-8a73-64bd7a59230b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:47792","PortSpecifier":{"PortValue":47792}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.32:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"60f14a4b-5012-4256-8a73-64bd7a59230b","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T18:14:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"60f14a4b-5012-4256-8a73-64bd7a59230b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:47792","PortSpecifier":{"PortValue":47792}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.32:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783620895,"nanos":947412589},"http":{"id":"60f14a4b-5012-4256-8a73-64bd7a59230b","method":"POST","headers":{":authority":"maas.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:14:55Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"60f14a4b-5012-4256-8a73-64bd7a59230b","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T18:14:55Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"60f14a4b-5012-4256-8a73-64bd7a59230b","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"8a03aca8-c185-4c8a-b6bd-33878f9e863c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=d0cd2685-b2e1-4705-9a11-a82c8e44ad44"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab31c6ab9b00"]}}
{"level":"debug","ts":"2026-07-09T18:14:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"60f14a4b-5012-4256-8a73-64bd7a59230b","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab31c6ab9b00"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=d0cd2685-b2e1-4705-9a11-a82c8e44ad44"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"8a03aca8-c185-4c8a-b6bd-33878f9e863c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.32:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:14:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"60f14a4b-5012-4256-8a73-64bd7a59230b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"60f14a4b-5012-4256-8a73-64bd7a59230b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"60f14a4b-5012-4256-8a73-64bd7a59230b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"60f14a4b-5012-4256-8a73-64bd7a59230b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T18:14:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"60f14a4b-5012-4256-8a73-64bd7a59230b","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T18:14:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"60f14a4b-5012-4256-8a73-64bd7a59230b","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T18:14:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"60f14a4b-5012-4256-8a73-64bd7a59230b","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T18:14:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"60f14a4b-5012-4256-8a73-64bd7a59230b","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T18:14:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6cb5b919-d431-4d78-96f3-3f9dbc1ccdff","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:47800","PortSpecifier":{"PortValue":47800}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.32:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6cb5b919-d431-4d78-96f3-3f9dbc1ccdff","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T18:14:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6cb5b919-d431-4d78-96f3-3f9dbc1ccdff","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:47800","PortSpecifier":{"PortValue":47800}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.32:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783620895,"nanos":996176689},"http":{"id":"6cb5b919-d431-4d78-96f3-3f9dbc1ccdff","method":"POST","headers":{":authority":"maas.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:14:55Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"6cb5b919-d431-4d78-96f3-3f9dbc1ccdff","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6cb5b919-d431-4d78-96f3-3f9dbc1ccdff","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"8a03aca8-c185-4c8a-b6bd-33878f9e863c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=d0cd2685-b2e1-4705-9a11-a82c8e44ad44"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab31c6ab9b00"]}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6cb5b919-d431-4d78-96f3-3f9dbc1ccdff","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab31c6ab9b00"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=d0cd2685-b2e1-4705-9a11-a82c8e44ad44"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"8a03aca8-c185-4c8a-b6bd-33878f9e863c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.32:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6cb5b919-d431-4d78-96f3-3f9dbc1ccdff","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6cb5b919-d431-4d78-96f3-3f9dbc1ccdff","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6cb5b919-d431-4d78-96f3-3f9dbc1ccdff","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"6cb5b919-d431-4d78-96f3-3f9dbc1ccdff","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6cb5b919-d431-4d78-96f3-3f9dbc1ccdff","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6cb5b919-d431-4d78-96f3-3f9dbc1ccdff","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6cb5b919-d431-4d78-96f3-3f9dbc1ccdff","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6cb5b919-d431-4d78-96f3-3f9dbc1ccdff","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e23d44f5-f443-4093-aedd-8508202306cf","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:47808","PortSpecifier":{"PortValue":47808}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.32:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e23d44f5-f443-4093-aedd-8508202306cf","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e23d44f5-f443-4093-aedd-8508202306cf","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:47808","PortSpecifier":{"PortValue":47808}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.32:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783620896,"nanos":31099083},"http":{"id":"e23d44f5-f443-4093-aedd-8508202306cf","method":"POST","headers":{":authority":"maas.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"e23d44f5-f443-4093-aedd-8508202306cf","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e23d44f5-f443-4093-aedd-8508202306cf","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"8a03aca8-c185-4c8a-b6bd-33878f9e863c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=d0cd2685-b2e1-4705-9a11-a82c8e44ad44"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab31c6ab9b00"]}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e23d44f5-f443-4093-aedd-8508202306cf","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab31c6ab9b00"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=d0cd2685-b2e1-4705-9a11-a82c8e44ad44"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"8a03aca8-c185-4c8a-b6bd-33878f9e863c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.32:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e23d44f5-f443-4093-aedd-8508202306cf","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e23d44f5-f443-4093-aedd-8508202306cf","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e23d44f5-f443-4093-aedd-8508202306cf","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"e23d44f5-f443-4093-aedd-8508202306cf","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e23d44f5-f443-4093-aedd-8508202306cf","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e23d44f5-f443-4093-aedd-8508202306cf","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e23d44f5-f443-4093-aedd-8508202306cf","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e23d44f5-f443-4093-aedd-8508202306cf","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ffd76be1-3ae4-4571-b2a9-6639b88f8524","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:47810","PortSpecifier":{"PortValue":47810}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.32:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ffd76be1-3ae4-4571-b2a9-6639b88f8524","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ffd76be1-3ae4-4571-b2a9-6639b88f8524","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:47810","PortSpecifier":{"PortValue":47810}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.32:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783620896,"nanos":67879667},"http":{"id":"ffd76be1-3ae4-4571-b2a9-6639b88f8524","method":"POST","headers":{":authority":"maas.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"ffd76be1-3ae4-4571-b2a9-6639b88f8524","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ffd76be1-3ae4-4571-b2a9-6639b88f8524","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"8a03aca8-c185-4c8a-b6bd-33878f9e863c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=d0cd2685-b2e1-4705-9a11-a82c8e44ad44"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab31c6ab9b00"]}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ffd76be1-3ae4-4571-b2a9-6639b88f8524","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab31c6ab9b00"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=d0cd2685-b2e1-4705-9a11-a82c8e44ad44"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"8a03aca8-c185-4c8a-b6bd-33878f9e863c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.32:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ffd76be1-3ae4-4571-b2a9-6639b88f8524","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ffd76be1-3ae4-4571-b2a9-6639b88f8524","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ffd76be1-3ae4-4571-b2a9-6639b88f8524","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"ffd76be1-3ae4-4571-b2a9-6639b88f8524","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ffd76be1-3ae4-4571-b2a9-6639b88f8524","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ffd76be1-3ae4-4571-b2a9-6639b88f8524","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ffd76be1-3ae4-4571-b2a9-6639b88f8524","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ffd76be1-3ae4-4571-b2a9-6639b88f8524","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b6807113-9805-4d4b-a0a6-08e551580d1b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:47818","PortSpecifier":{"PortValue":47818}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.32:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b6807113-9805-4d4b-a0a6-08e551580d1b","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b6807113-9805-4d4b-a0a6-08e551580d1b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:47818","PortSpecifier":{"PortValue":47818}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.32:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783620896,"nanos":97241620},"http":{"id":"b6807113-9805-4d4b-a0a6-08e551580d1b","method":"GET","headers":{":authority":"maas.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b6807113-9805-4d4b-a0a6-08e551580d1b","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1LWN15ZqIaBfFHTG4_xruZABCFoujtGhGIbraCvupJK6Lfke8OVUppzM44KOS"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b6807113-9805-4d4b-a0a6-08e551580d1b","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1LWN15ZqIaBfFHTG4_xruZABCFoujtGhGIbraCvupJK6Lfke8OVUppzM44KOS\"}"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b6807113-9805-4d4b-a0a6-08e551580d1b","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"56ce1130-d48b-46f5-aa43-6c6bd382b7e0","keyName":"e2e-revoketest-a-0","subscription":"e2e-revoke-sub-a","tenant":"models-as-a-service","userId":"56ce1130-d48b-46f5-aa43-6c6bd382b7e0","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b6807113-9805-4d4b-a0a6-08e551580d1b","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b6807113-9805-4d4b-a0a6-08e551580d1b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b6807113-9805-4d4b-a0a6-08e551580d1b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b6807113-9805-4d4b-a0a6-08e551580d1b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b6807113-9805-4d4b-a0a6-08e551580d1b","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b6807113-9805-4d4b-a0a6-08e551580d1b","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b6807113-9805-4d4b-a0a6-08e551580d1b","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-a"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"b6807113-9805-4d4b-a0a6-08e551580d1b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b6807113-9805-4d4b-a0a6-08e551580d1b","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b6807113-9805-4d4b-a0a6-08e551580d1b","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4cdcfef7-6d7d-486e-8695-ee295c99ea8b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.35:58350","PortSpecifier":{"PortValue":58350}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.32:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"4cdcfef7-6d7d-486e-8695-ee295c99ea8b","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4cdcfef7-6d7d-486e-8695-ee295c99ea8b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.35:58350","PortSpecifier":{"PortValue":58350}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.32:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783620896,"nanos":122558079},"http":{"id":"4cdcfef7-6d7d-486e-8695-ee295c99ea8b","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"4cdcfef7-6d7d-486e-8695-ee295c99ea8b","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1LWN15ZqIaBfFHTG4_xruZABCFoujtGhGIbraCvupJK6Lfke8OVUppzM44KOS"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"4cdcfef7-6d7d-486e-8695-ee295c99ea8b","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1LWN15ZqIaBfFHTG4_xruZABCFoujtGhGIbraCvupJK6Lfke8OVUppzM44KOS\"}"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"4cdcfef7-6d7d-486e-8695-ee295c99ea8b","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"56ce1130-d48b-46f5-aa43-6c6bd382b7e0","keyName":"e2e-revoketest-a-0","subscription":"e2e-revoke-sub-a","tenant":"models-as-a-service","userId":"56ce1130-d48b-46f5-aa43-6c6bd382b7e0","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"4cdcfef7-6d7d-486e-8695-ee295c99ea8b","config":"subscription-info","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"e2e-revoke-sub-a\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"4cdcfef7-6d7d-486e-8695-ee295c99ea8b","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-a","namespace":"models-as-a-service","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"4cdcfef7-6d7d-486e-8695-ee295c99ea8b","input":{"auth":{"identity":"Bearer **** simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-a","namespace":"models-as-a-service","phase":"Active","ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.32:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-1LWN15ZqIaBfFHTG4_xruZABCFoujtGhGIbraCvupJK6Lfke8OVUppzM44KOS","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.132.0.35","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctcjk2Z3YKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.32~maas-default-gateway-openshift-default-56654dcf7-r96gv.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.35","x-forwarded-proto":"https","x-maas-subscription":"e2e-revoke-sub-a","x-request-id":"4cdcfef7-6d7d-486e-8695-ee295c99ea8b"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"4cdcfef7-6d7d-486e-8695-ee295c99ea8b","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":122558079,"seconds":1783620896},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.35:58350","port":58350}}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4cdcfef7-6d7d-486e-8695-ee295c99ea8b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4cdcfef7-6d7d-486e-8695-ee295c99ea8b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4cdcfef7-6d7d-486e-8695-ee295c99ea8b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4cdcfef7-6d7d-486e-8695-ee295c99ea8b","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4cdcfef7-6d7d-486e-8695-ee295c99ea8b","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4cdcfef7-6d7d-486e-8695-ee295c99ea8b","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-a"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4cdcfef7-6d7d-486e-8695-ee295c99ea8b","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4cdcfef7-6d7d-486e-8695-ee295c99ea8b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"56ce1130-d48b-46f5-aa43-6c6bd382b7e0","keyName":"e2e-revoketest-a-0","selected_subscription":"e2e-revoke-sub-a","selected_subscription_key":"models-as-a-service/e2e-revoke-sub-a@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-a","namespace":"models-as-a-service","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4cdcfef7-6d7d-486e-8695-ee295c99ea8b","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4cdcfef7-6d7d-486e-8695-ee295c99ea8b","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"03c14014-61c8-4abf-bd2c-ae0138fd1bdc","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:47828","PortSpecifier":{"PortValue":47828}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.32:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"03c14014-61c8-4abf-bd2c-ae0138fd1bdc","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"03c14014-61c8-4abf-bd2c-ae0138fd1bdc","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:47828","PortSpecifier":{"PortValue":47828}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.32:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783620896,"nanos":156228684},"http":{"id":"03c14014-61c8-4abf-bd2c-ae0138fd1bdc","method":"GET","headers":{":authority":"maas.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"03c14014-61c8-4abf-bd2c-ae0138fd1bdc","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1o3FKk1o3XuBqS0p_6yxRZ94cSZLaLEtXQZ0lkQ27Mhjvyi4j52MYTsm0s5d"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"03c14014-61c8-4abf-bd2c-ae0138fd1bdc","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1o3FKk1o3XuBqS0p_6yxRZ94cSZLaLEtXQZ0lkQ27Mhjvyi4j52MYTsm0s5d\"}"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"03c14014-61c8-4abf-bd2c-ae0138fd1bdc","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"d48bcc6d-db99-4108-9863-a2274ae23507","keyName":"e2e-revoketest-a-1","subscription":"e2e-revoke-sub-a","tenant":"models-as-a-service","userId":"d48bcc6d-db99-4108-9863-a2274ae23507","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"03c14014-61c8-4abf-bd2c-ae0138fd1bdc","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"03c14014-61c8-4abf-bd2c-ae0138fd1bdc","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"03c14014-61c8-4abf-bd2c-ae0138fd1bdc","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"03c14014-61c8-4abf-bd2c-ae0138fd1bdc","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"03c14014-61c8-4abf-bd2c-ae0138fd1bdc","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"03c14014-61c8-4abf-bd2c-ae0138fd1bdc","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-a"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"03c14014-61c8-4abf-bd2c-ae0138fd1bdc","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"03c14014-61c8-4abf-bd2c-ae0138fd1bdc","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"03c14014-61c8-4abf-bd2c-ae0138fd1bdc","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"03c14014-61c8-4abf-bd2c-ae0138fd1bdc","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"91ed0417-deaf-47e6-9a80-7ede7ced87e0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.35:58350","PortSpecifier":{"PortValue":58350}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.32:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"91ed0417-deaf-47e6-9a80-7ede7ced87e0","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"91ed0417-deaf-47e6-9a80-7ede7ced87e0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.35:58350","PortSpecifier":{"PortValue":58350}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.32:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783620896,"nanos":163245687},"http":{"id":"91ed0417-deaf-47e6-9a80-7ede7ced87e0","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"91ed0417-deaf-47e6-9a80-7ede7ced87e0","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1o3FKk1o3XuBqS0p_6yxRZ94cSZLaLEtXQZ0lkQ27Mhjvyi4j52MYTsm0s5d"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"91ed0417-deaf-47e6-9a80-7ede7ced87e0","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1o3FKk1o3XuBqS0p_6yxRZ94cSZLaLEtXQZ0lkQ27Mhjvyi4j52MYTsm0s5d\"}"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"91ed0417-deaf-47e6-9a80-7ede7ced87e0","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"d48bcc6d-db99-4108-9863-a2274ae23507","keyName":"e2e-revoketest-a-1","subscription":"e2e-revoke-sub-a","tenant":"models-as-a-service","userId":"d48bcc6d-db99-4108-9863-a2274ae23507","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"91ed0417-deaf-47e6-9a80-7ede7ced87e0","config":"subscription-info","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"e2e-revoke-sub-a\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"91ed0417-deaf-47e6-9a80-7ede7ced87e0","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-a","namespace":"models-as-a-service","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"91ed0417-deaf-47e6-9a80-7ede7ced87e0","input":{"auth":{"identity":"Bearer **** simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-a","namespace":"models-as-a-service","phase":"Active","ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.32:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-1o3FKk1o3XuBqS0p_6yxRZ94cSZLaLEtXQZ0lkQ27Mhjvyi4j52MYTsm0s5d","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.132.0.35","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctcjk2Z3YKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.32~maas-default-gateway-openshift-default-56654dcf7-r96gv.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.35","x-forwarded-proto":"https","x-maas-subscription":"e2e-revoke-sub-a","x-request-id":"91ed0417-deaf-47e6-9a80-7ede7ced87e0"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"91ed0417-deaf-47e6-9a80-7ede7ced87e0","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":163245687,"seconds":1783620896},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.35:58350","port":58350}}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"91ed0417-deaf-47e6-9a80-7ede7ced87e0","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"91ed0417-deaf-47e6-9a80-7ede7ced87e0","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"91ed0417-deaf-47e6-9a80-7ede7ced87e0","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"91ed0417-deaf-47e6-9a80-7ede7ced87e0","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"91ed0417-deaf-47e6-9a80-7ede7ced87e0","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"91ed0417-deaf-47e6-9a80-7ede7ced87e0","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-a"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"91ed0417-deaf-47e6-9a80-7ede7ced87e0","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"91ed0417-deaf-47e6-9a80-7ede7ced87e0","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"d48bcc6d-db99-4108-9863-a2274ae23507","keyName":"e2e-revoketest-a-1","selected_subscription":"e2e-revoke-sub-a","selected_subscription_key":"models-as-a-service/e2e-revoke-sub-a@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-a","namespace":"models-as-a-service","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"91ed0417-deaf-47e6-9a80-7ede7ced87e0","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"91ed0417-deaf-47e6-9a80-7ede7ced87e0","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c89a6970-e4b6-4358-9df9-d8f62ae9afe3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:47838","PortSpecifier":{"PortValue":47838}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.32:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c89a6970-e4b6-4358-9df9-d8f62ae9afe3","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c89a6970-e4b6-4358-9df9-d8f62ae9afe3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:47838","PortSpecifier":{"PortValue":47838}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.32:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783620896,"nanos":195590769},"http":{"id":"c89a6970-e4b6-4358-9df9-d8f62ae9afe3","method":"GET","headers":{":authority":"maas.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"c89a6970-e4b6-4358-9df9-d8f62ae9afe3","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-4YmCPtiYCBrIR6kE_C2hO76fEDXkaBtlXrVvqA4L9qPQKdOU4uFVZGKeMjWA"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c89a6970-e4b6-4358-9df9-d8f62ae9afe3","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-4YmCPtiYCBrIR6kE_C2hO76fEDXkaBtlXrVvqA4L9qPQKdOU4uFVZGKeMjWA\"}"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c89a6970-e4b6-4358-9df9-d8f62ae9afe3","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"5dc31811-6dad-4a22-ad6c-721ad9088429","keyName":"e2e-revoketest-b-0","subscription":"e2e-revoke-sub-b","tenant":"models-as-a-service","userId":"5dc31811-6dad-4a22-ad6c-721ad9088429","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"c89a6970-e4b6-4358-9df9-d8f62ae9afe3","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c89a6970-e4b6-4358-9df9-d8f62ae9afe3","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c89a6970-e4b6-4358-9df9-d8f62ae9afe3","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c89a6970-e4b6-4358-9df9-d8f62ae9afe3","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c89a6970-e4b6-4358-9df9-d8f62ae9afe3","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c89a6970-e4b6-4358-9df9-d8f62ae9afe3","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-b"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c89a6970-e4b6-4358-9df9-d8f62ae9afe3","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"c89a6970-e4b6-4358-9df9-d8f62ae9afe3","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c89a6970-e4b6-4358-9df9-d8f62ae9afe3","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c89a6970-e4b6-4358-9df9-d8f62ae9afe3","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5feb0894-6638-48af-bcd8-17f33e57d446","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.35:58350","PortSpecifier":{"PortValue":58350}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.32:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5feb0894-6638-48af-bcd8-17f33e57d446","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5feb0894-6638-48af-bcd8-17f33e57d446","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.35:58350","PortSpecifier":{"PortValue":58350}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.32:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783620896,"nanos":204444595},"http":{"id":"5feb0894-6638-48af-bcd8-17f33e57d446","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5feb0894-6638-48af-bcd8-17f33e57d446","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-4YmCPtiYCBrIR6kE_C2hO76fEDXkaBtlXrVvqA4L9qPQKdOU4uFVZGKeMjWA"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5feb0894-6638-48af-bcd8-17f33e57d446","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-4YmCPtiYCBrIR6kE_C2hO76fEDXkaBtlXrVvqA4L9qPQKdOU4uFVZGKeMjWA\"}"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5feb0894-6638-48af-bcd8-17f33e57d446","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"5dc31811-6dad-4a22-ad6c-721ad9088429","keyName":"e2e-revoketest-b-0","subscription":"e2e-revoke-sub-b","tenant":"models-as-a-service","userId":"5dc31811-6dad-4a22-ad6c-721ad9088429","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5feb0894-6638-48af-bcd8-17f33e57d446","config":"subscription-info","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"e2e-revoke-sub-b\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5feb0894-6638-48af-bcd8-17f33e57d446","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5feb0894-6638-48af-bcd8-17f33e57d446","input":{"auth":{"identity":"Bearer **** simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.32:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-4YmCPtiYCBrIR6kE_C2hO76fEDXkaBtlXrVvqA4L9qPQKdOU4uFVZGKeMjWA","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.132.0.35","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctcjk2Z3YKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.32~maas-default-gateway-openshift-default-56654dcf7-r96gv.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.35","x-forwarded-proto":"https","x-maas-subscription":"e2e-revoke-sub-b","x-request-id":"5feb0894-6638-48af-bcd8-17f33e57d446"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"5feb0894-6638-48af-bcd8-17f33e57d446","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":204444595,"seconds":1783620896},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.35:58350","port":58350}}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5feb0894-6638-48af-bcd8-17f33e57d446","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5feb0894-6638-48af-bcd8-17f33e57d446","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5feb0894-6638-48af-bcd8-17f33e57d446","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5feb0894-6638-48af-bcd8-17f33e57d446","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5feb0894-6638-48af-bcd8-17f33e57d446","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5feb0894-6638-48af-bcd8-17f33e57d446","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5feb0894-6638-48af-bcd8-17f33e57d446","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-b"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5feb0894-6638-48af-bcd8-17f33e57d446","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"5dc31811-6dad-4a22-ad6c-721ad9088429","keyName":"e2e-revoketest-b-0","selected_subscription":"e2e-revoke-sub-b","selected_subscription_key":"models-as-a-service/e2e-revoke-sub-b@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5feb0894-6638-48af-bcd8-17f33e57d446","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5feb0894-6638-48af-bcd8-17f33e57d446","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"63370153-61ba-403b-b6f5-f1c39e9edcb4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:47852","PortSpecifier":{"PortValue":47852}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.32:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"63370153-61ba-403b-b6f5-f1c39e9edcb4","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"63370153-61ba-403b-b6f5-f1c39e9edcb4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:47852","PortSpecifier":{"PortValue":47852}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.32:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783620896,"nanos":232681841},"http":{"id":"63370153-61ba-403b-b6f5-f1c39e9edcb4","method":"GET","headers":{":authority":"maas.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"63370153-61ba-403b-b6f5-f1c39e9edcb4","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1SGy357CdCyLd9Vwd_RBWiaPaCZEVzl4ueAb0bL4AfUeOeAu7fAjmjcZJRQnH"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"63370153-61ba-403b-b6f5-f1c39e9edcb4","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1SGy357CdCyLd9Vwd_RBWiaPaCZEVzl4ueAb0bL4AfUeOeAu7fAjmjcZJRQnH\"}"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"63370153-61ba-403b-b6f5-f1c39e9edcb4","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"fbd47ee6-d9b1-4ab2-ac4d-27fb711488df","keyName":"e2e-revoketest-b-1","subscription":"e2e-revoke-sub-b","tenant":"models-as-a-service","userId":"fbd47ee6-d9b1-4ab2-ac4d-27fb711488df","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"63370153-61ba-403b-b6f5-f1c39e9edcb4","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"63370153-61ba-403b-b6f5-f1c39e9edcb4","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"63370153-61ba-403b-b6f5-f1c39e9edcb4","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"63370153-61ba-403b-b6f5-f1c39e9edcb4","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"63370153-61ba-403b-b6f5-f1c39e9edcb4","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"63370153-61ba-403b-b6f5-f1c39e9edcb4","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"63370153-61ba-403b-b6f5-f1c39e9edcb4","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-b"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"63370153-61ba-403b-b6f5-f1c39e9edcb4","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"63370153-61ba-403b-b6f5-f1c39e9edcb4","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"63370153-61ba-403b-b6f5-f1c39e9edcb4","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d5590238-a9de-4078-843a-1a9838e5cac3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.35:58350","PortSpecifier":{"PortValue":58350}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.32:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d5590238-a9de-4078-843a-1a9838e5cac3","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d5590238-a9de-4078-843a-1a9838e5cac3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.35:58350","PortSpecifier":{"PortValue":58350}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.32:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783620896,"nanos":240398490},"http":{"id":"d5590238-a9de-4078-843a-1a9838e5cac3","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d5590238-a9de-4078-843a-1a9838e5cac3","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1SGy357CdCyLd9Vwd_RBWiaPaCZEVzl4ueAb0bL4AfUeOeAu7fAjmjcZJRQnH"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d5590238-a9de-4078-843a-1a9838e5cac3","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1SGy357CdCyLd9Vwd_RBWiaPaCZEVzl4ueAb0bL4AfUeOeAu7fAjmjcZJRQnH\"}"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d5590238-a9de-4078-843a-1a9838e5cac3","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"fbd47ee6-d9b1-4ab2-ac4d-27fb711488df","keyName":"e2e-revoketest-b-1","subscription":"e2e-revoke-sub-b","tenant":"models-as-a-service","userId":"fbd47ee6-d9b1-4ab2-ac4d-27fb711488df","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d5590238-a9de-4078-843a-1a9838e5cac3","config":"subscription-info","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"e2e-revoke-sub-b\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d5590238-a9de-4078-843a-1a9838e5cac3","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d5590238-a9de-4078-843a-1a9838e5cac3","input":{"auth":{"identity":"Bearer **** simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.32:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-1SGy357CdCyLd9Vwd_RBWiaPaCZEVzl4ueAb0bL4AfUeOeAu7fAjmjcZJRQnH","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.132.0.35","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctcjk2Z3YKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.32~maas-default-gateway-openshift-default-56654dcf7-r96gv.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.35","x-forwarded-proto":"https","x-maas-subscription":"e2e-revoke-sub-b","x-request-id":"d5590238-a9de-4078-843a-1a9838e5cac3"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"d5590238-a9de-4078-843a-1a9838e5cac3","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":240398490,"seconds":1783620896},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.35:58350","port":58350}}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d5590238-a9de-4078-843a-1a9838e5cac3","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d5590238-a9de-4078-843a-1a9838e5cac3","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d5590238-a9de-4078-843a-1a9838e5cac3","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d5590238-a9de-4078-843a-1a9838e5cac3","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d5590238-a9de-4078-843a-1a9838e5cac3","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d5590238-a9de-4078-843a-1a9838e5cac3","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d5590238-a9de-4078-843a-1a9838e5cac3","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-b"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d5590238-a9de-4078-843a-1a9838e5cac3","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"fbd47ee6-d9b1-4ab2-ac4d-27fb711488df","keyName":"e2e-revoketest-b-1","selected_subscription":"e2e-revoke-sub-b","selected_subscription_key":"models-as-a-service/e2e-revoke-sub-b@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d5590238-a9de-4078-843a-1a9838e5cac3","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T18:14:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d5590238-a9de-4078-843a-1a9838e5cac3","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"440dfd47-5cf0-41f6-8ae8-8732d8526d95","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:48252","PortSpecifier":{"PortValue":48252}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.32:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"440dfd47-5cf0-41f6-8ae8-8732d8526d95","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"440dfd47-5cf0-41f6-8ae8-8732d8526d95","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:48252","PortSpecifier":{"PortValue":48252}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.32:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783620900,"nanos":506932557},"http":{"id":"440dfd47-5cf0-41f6-8ae8-8732d8526d95","method":"GET","headers":{":authority":"maas.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"440dfd47-5cf0-41f6-8ae8-8732d8526d95","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1LWN15ZqIaBfFHTG4_xruZABCFoujtGhGIbraCvupJK6Lfke8OVUppzM44KOS"}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"440dfd47-5cf0-41f6-8ae8-8732d8526d95","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1LWN15ZqIaBfFHTG4_xruZABCFoujtGhGIbraCvupJK6Lfke8OVUppzM44KOS\"}"}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"440dfd47-5cf0-41f6-8ae8-8732d8526d95","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"reason":"key revoked or expired","tenant":"","valid":false}}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"440dfd47-5cf0-41f6-8ae8-8732d8526d95","input":{"auth":{"identity":"Bearer **** revoked or expired","tenant":"","valid":false}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.32:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"440dfd47-5cf0-41f6-8ae8-8732d8526d95","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access denied","request id":"440dfd47-5cf0-41f6-8ae8-8732d8526d95","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"reason":"Unauthorized"}
{"level":"info","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"440dfd47-5cf0-41f6-8ae8-8732d8526d95","authorized":false,"response":"PERMISSION_DENIED","object":{"code":7,"status":403,"message":"Unauthorized"}}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"440dfd47-5cf0-41f6-8ae8-8732d8526d95","authorized":false,"response":"PERMISSION_DENIED","object":{"code":7,"status":403,"message":"Unauthorized","headers":[{"content-type":"application/json"},{"x-ext-auth-reason":""}],"body":"{\"error\": {\"type\": \"permission_error\", \"message\": \"API key is invalid or has been revoked\"}}"}}
{"level":"info","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"dfbfc334-9a00-44f1-8152-97168f6cd901","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:48266","PortSpecifier":{"PortValue":48266}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.32:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"dfbfc334-9a00-44f1-8152-97168f6cd901","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"dfbfc334-9a00-44f1-8152-97168f6cd901","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:48266","PortSpecifier":{"PortValue":48266}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.32:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783620900,"nanos":536716354},"http":{"id":"dfbfc334-9a00-44f1-8152-97168f6cd901","method":"GET","headers":{":authority":"maas.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"dfbfc334-9a00-44f1-8152-97168f6cd901","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1o3FKk1o3XuBqS0p_6yxRZ94cSZLaLEtXQZ0lkQ27Mhjvyi4j52MYTsm0s5d"}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"dfbfc334-9a00-44f1-8152-97168f6cd901","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1o3FKk1o3XuBqS0p_6yxRZ94cSZLaLEtXQZ0lkQ27Mhjvyi4j52MYTsm0s5d\"}"}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"dfbfc334-9a00-44f1-8152-97168f6cd901","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"reason":"key revoked or expired","tenant":"","valid":false}}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"dfbfc334-9a00-44f1-8152-97168f6cd901","input":{"auth":{"identity":"Bearer **** revoked or expired","tenant":"","valid":false}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.32:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dfbfc334-9a00-44f1-8152-97168f6cd901","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access denied","request id":"dfbfc334-9a00-44f1-8152-97168f6cd901","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"reason":"Unauthorized"}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline","msg":"skipping config","request id":"dfbfc334-9a00-44f1-8152-97168f6cd901","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"reason":"context canceled"}
{"level":"info","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"dfbfc334-9a00-44f1-8152-97168f6cd901","authorized":false,"response":"PERMISSION_DENIED","object":{"code":7,"status":403,"message":"Unauthorized"}}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"dfbfc334-9a00-44f1-8152-97168f6cd901","authorized":false,"response":"PERMISSION_DENIED","object":{"code":7,"status":403,"message":"Unauthorized","headers":[{"content-type":"application/json"},{"x-ext-auth-reason":""}],"body":"{\"error\": {\"type\": \"permission_error\", \"message\": \"API key is invalid or has been revoked\"}}"}}
{"level":"info","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7464c06f-df54-49f3-9d23-5d6ce0358a19","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:48280","PortSpecifier":{"PortValue":48280}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.32:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"7464c06f-df54-49f3-9d23-5d6ce0358a19","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7464c06f-df54-49f3-9d23-5d6ce0358a19","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:48280","PortSpecifier":{"PortValue":48280}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.32:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783620900,"nanos":563320783},"http":{"id":"7464c06f-df54-49f3-9d23-5d6ce0358a19","method":"GET","headers":{":authority":"maas.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"7464c06f-df54-49f3-9d23-5d6ce0358a19","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-4YmCPtiYCBrIR6kE_C2hO76fEDXkaBtlXrVvqA4L9qPQKdOU4uFVZGKeMjWA"}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"7464c06f-df54-49f3-9d23-5d6ce0358a19","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-4YmCPtiYCBrIR6kE_C2hO76fEDXkaBtlXrVvqA4L9qPQKdOU4uFVZGKeMjWA\"}"}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"7464c06f-df54-49f3-9d23-5d6ce0358a19","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"5dc31811-6dad-4a22-ad6c-721ad9088429","keyName":"e2e-revoketest-b-0","subscription":"e2e-revoke-sub-b","tenant":"models-as-a-service","userId":"5dc31811-6dad-4a22-ad6c-721ad9088429","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"7464c06f-df54-49f3-9d23-5d6ce0358a19","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7464c06f-df54-49f3-9d23-5d6ce0358a19","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7464c06f-df54-49f3-9d23-5d6ce0358a19","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7464c06f-df54-49f3-9d23-5d6ce0358a19","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7464c06f-df54-49f3-9d23-5d6ce0358a19","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7464c06f-df54-49f3-9d23-5d6ce0358a19","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7464c06f-df54-49f3-9d23-5d6ce0358a19","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-b"}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"7464c06f-df54-49f3-9d23-5d6ce0358a19","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7464c06f-df54-49f3-9d23-5d6ce0358a19","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7464c06f-df54-49f3-9d23-5d6ce0358a19","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"36391c44-2e13-496d-bbcd-d29b25148080","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.35:58350","PortSpecifier":{"PortValue":58350}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.32:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"36391c44-2e13-496d-bbcd-d29b25148080","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"36391c44-2e13-496d-bbcd-d29b25148080","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.35:58350","PortSpecifier":{"PortValue":58350}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.32:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783620900,"nanos":575371343},"http":{"id":"36391c44-2e13-496d-bbcd-d29b25148080","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"36391c44-2e13-496d-bbcd-d29b25148080","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-4YmCPtiYCBrIR6kE_C2hO76fEDXkaBtlXrVvqA4L9qPQKdOU4uFVZGKeMjWA"}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"36391c44-2e13-496d-bbcd-d29b25148080","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-4YmCPtiYCBrIR6kE_C2hO76fEDXkaBtlXrVvqA4L9qPQKdOU4uFVZGKeMjWA\"}"}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"36391c44-2e13-496d-bbcd-d29b25148080","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"5dc31811-6dad-4a22-ad6c-721ad9088429","keyName":"e2e-revoketest-b-0","subscription":"e2e-revoke-sub-b","tenant":"models-as-a-service","userId":"5dc31811-6dad-4a22-ad6c-721ad9088429","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"36391c44-2e13-496d-bbcd-d29b25148080","config":"subscription-info","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"e2e-revoke-sub-b\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"36391c44-2e13-496d-bbcd-d29b25148080","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"36391c44-2e13-496d-bbcd-d29b25148080","input":{"auth":{"identity":"Bearer **** simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.32:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-4YmCPtiYCBrIR6kE_C2hO76fEDXkaBtlXrVvqA4L9qPQKdOU4uFVZGKeMjWA","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.132.0.35","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctcjk2Z3YKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.32~maas-default-gateway-openshift-default-56654dcf7-r96gv.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.35","x-forwarded-proto":"https","x-maas-subscription":"e2e-revoke-sub-b","x-request-id":"36391c44-2e13-496d-bbcd-d29b25148080"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"36391c44-2e13-496d-bbcd-d29b25148080","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":575371343,"seconds":1783620900},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.35:58350","port":58350}}}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"36391c44-2e13-496d-bbcd-d29b25148080","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"36391c44-2e13-496d-bbcd-d29b25148080","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"36391c44-2e13-496d-bbcd-d29b25148080","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"36391c44-2e13-496d-bbcd-d29b25148080","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"36391c44-2e13-496d-bbcd-d29b25148080","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"36391c44-2e13-496d-bbcd-d29b25148080","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"36391c44-2e13-496d-bbcd-d29b25148080","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-b"}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"36391c44-2e13-496d-bbcd-d29b25148080","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"5dc31811-6dad-4a22-ad6c-721ad9088429","keyName":"e2e-revoketest-b-0","selected_subscription":"e2e-revoke-sub-b","selected_subscription_key":"models-as-a-service/e2e-revoke-sub-b@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"36391c44-2e13-496d-bbcd-d29b25148080","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"36391c44-2e13-496d-bbcd-d29b25148080","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"abf7d910-4990-4517-ba38-60e6c7a4519f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:48282","PortSpecifier":{"PortValue":48282}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.32:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"abf7d910-4990-4517-ba38-60e6c7a4519f","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"abf7d910-4990-4517-ba38-60e6c7a4519f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:48282","PortSpecifier":{"PortValue":48282}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.32:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783620900,"nanos":612229398},"http":{"id":"abf7d910-4990-4517-ba38-60e6c7a4519f","method":"GET","headers":{":authority":"maas.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"abf7d910-4990-4517-ba38-60e6c7a4519f","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1SGy357CdCyLd9Vwd_RBWiaPaCZEVzl4ueAb0bL4AfUeOeAu7fAjmjcZJRQnH"}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"abf7d910-4990-4517-ba38-60e6c7a4519f","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1SGy357CdCyLd9Vwd_RBWiaPaCZEVzl4ueAb0bL4AfUeOeAu7fAjmjcZJRQnH\"}"}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"abf7d910-4990-4517-ba38-60e6c7a4519f","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"fbd47ee6-d9b1-4ab2-ac4d-27fb711488df","keyName":"e2e-revoketest-b-1","subscription":"e2e-revoke-sub-b","tenant":"models-as-a-service","userId":"fbd47ee6-d9b1-4ab2-ac4d-27fb711488df","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"abf7d910-4990-4517-ba38-60e6c7a4519f","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"abf7d910-4990-4517-ba38-60e6c7a4519f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"abf7d910-4990-4517-ba38-60e6c7a4519f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"abf7d910-4990-4517-ba38-60e6c7a4519f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"abf7d910-4990-4517-ba38-60e6c7a4519f","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"abf7d910-4990-4517-ba38-60e6c7a4519f","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"abf7d910-4990-4517-ba38-60e6c7a4519f","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-b"}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"abf7d910-4990-4517-ba38-60e6c7a4519f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"abf7d910-4990-4517-ba38-60e6c7a4519f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"abf7d910-4990-4517-ba38-60e6c7a4519f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ec3d02cc-0771-490d-a776-649a7f203979","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.35:58350","PortSpecifier":{"PortValue":58350}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.32:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ec3d02cc-0771-490d-a776-649a7f203979","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ec3d02cc-0771-490d-a776-649a7f203979","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.35:58350","PortSpecifier":{"PortValue":58350}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.32:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783620900,"nanos":624434328},"http":{"id":"ec3d02cc-0771-490d-a776-649a7f203979","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ec3d02cc-0771-490d-a776-649a7f203979","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1SGy357CdCyLd9Vwd_RBWiaPaCZEVzl4ueAb0bL4AfUeOeAu7fAjmjcZJRQnH"}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ec3d02cc-0771-490d-a776-649a7f203979","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1SGy357CdCyLd9Vwd_RBWiaPaCZEVzl4ueAb0bL4AfUeOeAu7fAjmjcZJRQnH\"}"}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ec3d02cc-0771-490d-a776-649a7f203979","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"fbd47ee6-d9b1-4ab2-ac4d-27fb711488df","keyName":"e2e-revoketest-b-1","subscription":"e2e-revoke-sub-b","tenant":"models-as-a-service","userId":"fbd47ee6-d9b1-4ab2-ac4d-27fb711488df","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ec3d02cc-0771-490d-a776-649a7f203979","config":"subscription-info","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"e2e-revoke-sub-b\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ec3d02cc-0771-490d-a776-649a7f203979","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ec3d02cc-0771-490d-a776-649a7f203979","input":{"auth":{"identity":"Bearer **** simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.32:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-1SGy357CdCyLd9Vwd_RBWiaPaCZEVzl4ueAb0bL4AfUeOeAu7fAjmjcZJRQnH","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.132.0.35","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctcjk2Z3YKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.32~maas-default-gateway-openshift-default-56654dcf7-r96gv.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.35","x-forwarded-proto":"https","x-maas-subscription":"e2e-revoke-sub-b","x-request-id":"ec3d02cc-0771-490d-a776-649a7f203979"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"ec3d02cc-0771-490d-a776-649a7f203979","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":624434328,"seconds":1783620900},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.35:58350","port":58350}}}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ec3d02cc-0771-490d-a776-649a7f203979","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ec3d02cc-0771-490d-a776-649a7f203979","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ec3d02cc-0771-490d-a776-649a7f203979","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ec3d02cc-0771-490d-a776-649a7f203979","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ec3d02cc-0771-490d-a776-649a7f203979","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ec3d02cc-0771-490d-a776-649a7f203979","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-b"}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ec3d02cc-0771-490d-a776-649a7f203979","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ec3d02cc-0771-490d-a776-649a7f203979","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"fbd47ee6-d9b1-4ab2-ac4d-27fb711488df","keyName":"e2e-revoketest-b-1","selected_subscription":"e2e-revoke-sub-b","selected_subscription_key":"models-as-a-service/e2e-revoke-sub-b@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ec3d02cc-0771-490d-a776-649a7f203979","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ec3d02cc-0771-490d-a776-649a7f203979","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5b65beed-e627-4875-ade2-b66cd6ba0e6e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:48284","PortSpecifier":{"PortValue":48284}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.32:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5b65beed-e627-4875-ade2-b66cd6ba0e6e","method":"DELETE","path":"/maas-api/v1/api-keys/5dc31811-6dad-4a22-ad6c-721ad9088429","host":"maas.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5b65beed-e627-4875-ade2-b66cd6ba0e6e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:48284","PortSpecifier":{"PortValue":48284}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.32:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783620900,"nanos":663344071},"http":{"id":"5b65beed-e627-4875-ade2-b66cd6ba0e6e","method":"DELETE","headers":{":authority":"maas.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/5dc31811-6dad-4a22-ad6c-721ad9088429",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"5b65beed-e627-4875-ade2-b66cd6ba0e6e","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5b65beed-e627-4875-ade2-b66cd6ba0e6e","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"8a03aca8-c185-4c8a-b6bd-33878f9e863c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=d0cd2685-b2e1-4705-9a11-a82c8e44ad44"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab31c6ab9b00"]}}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5b65beed-e627-4875-ade2-b66cd6ba0e6e","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab31c6ab9b00"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=d0cd2685-b2e1-4705-9a11-a82c8e44ad44"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"8a03aca8-c185-4c8a-b6bd-33878f9e863c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.32:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/5dc31811-6dad-4a22-ad6c-721ad9088429",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5b65beed-e627-4875-ade2-b66cd6ba0e6e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5b65beed-e627-4875-ade2-b66cd6ba0e6e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5b65beed-e627-4875-ade2-b66cd6ba0e6e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"5b65beed-e627-4875-ade2-b66cd6ba0e6e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5b65beed-e627-4875-ade2-b66cd6ba0e6e","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5b65beed-e627-4875-ade2-b66cd6ba0e6e","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5b65beed-e627-4875-ade2-b66cd6ba0e6e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5b65beed-e627-4875-ade2-b66cd6ba0e6e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7d52d7f5-6390-428b-a98a-8c4bc68db40d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:48290","PortSpecifier":{"PortValue":48290}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.32:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"7d52d7f5-6390-428b-a98a-8c4bc68db40d","method":"DELETE","path":"/maas-api/v1/api-keys/fbd47ee6-d9b1-4ab2-ac4d-27fb711488df","host":"maas.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7d52d7f5-6390-428b-a98a-8c4bc68db40d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:48290","PortSpecifier":{"PortValue":48290}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.32:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783620900,"nanos":696289458},"http":{"id":"7d52d7f5-6390-428b-a98a-8c4bc68db40d","method":"DELETE","headers":{":authority":"maas.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/fbd47ee6-d9b1-4ab2-ac4d-27fb711488df",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"7d52d7f5-6390-428b-a98a-8c4bc68db40d","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"7d52d7f5-6390-428b-a98a-8c4bc68db40d","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"8a03aca8-c185-4c8a-b6bd-33878f9e863c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=d0cd2685-b2e1-4705-9a11-a82c8e44ad44"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab31c6ab9b00"]}}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"7d52d7f5-6390-428b-a98a-8c4bc68db40d","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab31c6ab9b00"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=d0cd2685-b2e1-4705-9a11-a82c8e44ad44"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"8a03aca8-c185-4c8a-b6bd-33878f9e863c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.32:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.0bc52a23-f4c3-43e6-bdba-ab31c6ab9b00.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/fbd47ee6-d9b1-4ab2-ac4d-27fb711488df",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7d52d7f5-6390-428b-a98a-8c4bc68db40d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7d52d7f5-6390-428b-a98a-8c4bc68db40d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7d52d7f5-6390-428b-a98a-8c4bc68db40d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"7d52d7f5-6390-428b-a98a-8c4bc68db40d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7d52d7f5-6390-428b-a98a-8c4bc68db40d","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7d52d7f5-6390-428b-a98a-8c4bc68db40d","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7d52d7f5-6390-428b-a98a-8c4bc68db40d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T18:15:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7d52d7f5-6390-428b-a98a-8c4bc68db40d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T18:15:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3455d8f8a1e11fba85909b8231717c92033ad1c6a916ad9ced0ad92b6291b67c"}
{"level":"info","ts":"2026-07-09T18:15:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/8faf4c28b604919a04688c9d0b71f043cb8e28cc00b2ed987389e5b81eb3b7b5"}
{"level":"info","ts":"2026-07-09T18:15:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ddff7ede1f151ef30e3f545ea4b684ed64ab790bace80fb118471e204787c69c"}
{"level":"info","ts":"2026-07-09T18:15:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/328ac1cd7fa902c7251c9136cce18d5edaf6548fd739c05b51324ea9c56c169e"}
{"level":"info","ts":"2026-07-09T18:15:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9022bf871584c1ee8e545b8083a1b2050a98b04db4f75e1d571054cf14324e3f"}
{"level":"info","ts":"2026-07-09T18:15:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ee6545a443da010e397446e5aea8407d7494c0bf8df9dfd263e5d11d03b99e7e"}
{"level":"info","ts":"2026-07-09T18:15:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/52207e8808a5af400ac23bdc55d7ab4dfa8777350b1e22159ca72575a356c947"}
{"level":"info","ts":"2026-07-09T18:15:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ccfc7249f981cee0416a0e386cba8cdba0b3cf266e9e99878df6be42ce87f9d8"}
{"level":"info","ts":"2026-07-09T18:15:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/64782d5b5dc52a650fc17c002109a570a7536b812428118134f5d7689a628373"}
{"level":"info","ts":"2026-07-09T18:15:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/858e15e1a7184d729f8a1f69fcfd3b082b5fa0a39b96378ef7ff02e147dfce8c"}
{"level":"info","ts":"2026-07-09T18:15:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3551875117ccf3984c27a02b4864f4cd1c57e8ac94e5723b572e4ebbb2bcda9f"}
{"level":"info","ts":"2026-07-09T18:15:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7fbac276220634445d8f6817b6d43203fb85387d7cb81c1c8e2d907b2dfcaaac"}
{"level":"info","ts":"2026-07-09T18:15:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/612e4d6571f54392dc4bb1845f7d87f335994587f999a2d7f8cd344aeaf1d36f"}
{"level":"info","ts":"2026-07-09T18:15:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/02872928c34520c992744c56cd2a8decc2c72faa0371a3cf66a4596769899cd6"}
{"level":"info","ts":"2026-07-09T18:15:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4497f2636ed35517f7996014ddb76e47743246fa17c97278f7a75525a38f8f32"}
{"level":"info","ts":"2026-07-09T18:15:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d2c73e6df73ec2c6b7e8bcee8aeaa086e6784eb2f32fcdd5956c8c7a26a9f91f"}
{"level":"info","ts":"2026-07-09T18:15:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6fff71fcd45a294412257cdd7721672479b46bddf883bead293812798aca2799"}
{"level":"info","ts":"2026-07-09T18:15:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/da41b07f92d255d3238b29ad30df8c0ee8a4fe5642aa41d9956e7ed89f5cb3bc"}
{"level":"info","ts":"2026-07-09T18:15:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9b729fee5f198546b25447d43f6aac3c5d2da0ab25e3729b865bc3257e29673a"}
{"level":"info","ts":"2026-07-09T18:15:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d0dc982a4b2bb71b26b48cdc76131f83b5c5ef6691a5682c984d9c772913a6de"}
{"level":"info","ts":"2026-07-09T18:15:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3682972e0c81bfc88ef826fc0824c34a3a6f73b8888ffa4426c86a341dd9b2cc"}
{"level":"info","ts":"2026-07-09T18:15:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d8e0850808cc3464b9bc0513c8149e79e80d6d1342e3ad0fcb38a541c9d49a0d"}
{"level":"info","ts":"2026-07-09T18:15:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d9bdad4f2209ade368fb8e3e9899aed674691a49f320a4c7056f5befc66c4d25"}
{"level":"info","ts":"2026-07-09T18:15:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3b3177991297fdbae2c007ceba4a843cc4cee6ffb746764254c1b3c63519840e"}