{"level":"debug","ts":"2026-07-08T21:48:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9e6ed0b779b4e60c924bb81dba908ed945d89646ab3f5d68720479bed1bf0c4d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-08T21:48:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9e6ed0b779b4e60c924bb81dba908ed945d89646ab3f5d68720479bed1bf0c4d"}
{"level":"debug","ts":"2026-07-08T21:48:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"cd3683d92f223e9e9c945cb1d4303f74bbf05a57822c225d08cb0cac9c7dfae1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-08T21:48:24Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-08T21:48:24Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-08T21:48:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"cd3683d92f223e9e9c945cb1d4303f74bbf05a57822c225d08cb0cac9c7dfae1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T21:48:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9e6ed0b779b4e60c924bb81dba908ed945d89646ab3f5d68720479bed1bf0c4d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T21:48:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cd3683d92f223e9e9c945cb1d4303f74bbf05a57822c225d08cb0cac9c7dfae1","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-08T21:48:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9e6ed0b779b4e60c924bb81dba908ed945d89646ab3f5d68720479bed1bf0c4d"}
{"level":"debug","ts":"2026-07-08T21:48:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"cd3683d92f223e9e9c945cb1d4303f74bbf05a57822c225d08cb0cac9c7dfae1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-08T21:48:24Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-08T21:48:24Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-08T21:48:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"cd3683d92f223e9e9c945cb1d4303f74bbf05a57822c225d08cb0cac9c7dfae1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T21:48:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cd3683d92f223e9e9c945cb1d4303f74bbf05a57822c225d08cb0cac9c7dfae1","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-08T21:48:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cd3683d92f223e9e9c945cb1d4303f74bbf05a57822c225d08cb0cac9c7dfae1"}
{"level":"debug","ts":"2026-07-08T21:48:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cd3683d92f223e9e9c945cb1d4303f74bbf05a57822c225d08cb0cac9c7dfae1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T21:48:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9e6ed0b779b4e60c924bb81dba908ed945d89646ab3f5d68720479bed1bf0c4d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-08T21:48:24Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-08T21:48:24Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9e6ed0b779b4e60c924bb81dba908ed945d89646ab3f5d68720479bed1bf0c4d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-08T21:48:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cd3683d92f223e9e9c945cb1d4303f74bbf05a57822c225d08cb0cac9c7dfae1"}
{"level":"info","ts":"2026-07-08T21:48:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9e6ed0b779b4e60c924bb81dba908ed945d89646ab3f5d68720479bed1bf0c4d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T21:48:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9e6ed0b779b4e60c924bb81dba908ed945d89646ab3f5d68720479bed1bf0c4d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-08T21:48:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9e6ed0b779b4e60c924bb81dba908ed945d89646ab3f5d68720479bed1bf0c4d"}
{"level":"debug","ts":"2026-07-08T21:48:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"cd3683d92f223e9e9c945cb1d4303f74bbf05a57822c225d08cb0cac9c7dfae1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-08T21:48:24Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-08T21:48:24Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["cd3683d92f223e9e9c945cb1d4303f74bbf05a57822c225d08cb0cac9c7dfae1"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-08T21:48:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"cd3683d92f223e9e9c945cb1d4303f74bbf05a57822c225d08cb0cac9c7dfae1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T21:48:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"cd3683d92f223e9e9c945cb1d4303f74bbf05a57822c225d08cb0cac9c7dfae1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-08T21:48:24Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-08T21:48:24Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-08T21:48:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"cd3683d92f223e9e9c945cb1d4303f74bbf05a57822c225d08cb0cac9c7dfae1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T21:48:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cd3683d92f223e9e9c945cb1d4303f74bbf05a57822c225d08cb0cac9c7dfae1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T21:48:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cd3683d92f223e9e9c945cb1d4303f74bbf05a57822c225d08cb0cac9c7dfae1","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-08T21:48:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cd3683d92f223e9e9c945cb1d4303f74bbf05a57822c225d08cb0cac9c7dfae1"}
{"level":"debug","ts":"2026-07-08T21:48:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cd3683d92f223e9e9c945cb1d4303f74bbf05a57822c225d08cb0cac9c7dfae1","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-08T21:48:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cd3683d92f223e9e9c945cb1d4303f74bbf05a57822c225d08cb0cac9c7dfae1"}
{"level":"debug","ts":"2026-07-08T21:48:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"63900473334735a68ffa3164fef3b6a2368e3d36ca04361533f1f52f385d1d8c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-08T21:48:24Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-08T21:48:24Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-08T21:48:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"63900473334735a68ffa3164fef3b6a2368e3d36ca04361533f1f52f385d1d8c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T21:48:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0e2113ac80d7650582a092eca892a76a0216af28256ba5a93dbe5e8e060356d9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-08T21:48:24Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-08T21:48:24Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-08T21:48:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/63900473334735a68ffa3164fef3b6a2368e3d36ca04361533f1f52f385d1d8c"}
{"level":"info","ts":"2026-07-08T21:48:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0e2113ac80d7650582a092eca892a76a0216af28256ba5a93dbe5e8e060356d9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T21:48:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"63900473334735a68ffa3164fef3b6a2368e3d36ca04361533f1f52f385d1d8c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-08T21:48:24Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-08T21:48:24Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["63900473334735a68ffa3164fef3b6a2368e3d36ca04361533f1f52f385d1d8c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-08T21:48:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"63900473334735a68ffa3164fef3b6a2368e3d36ca04361533f1f52f385d1d8c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T21:48:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0e2113ac80d7650582a092eca892a76a0216af28256ba5a93dbe5e8e060356d9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-08T21:48:24Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-08T21:48:24Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-08T21:48:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0e2113ac80d7650582a092eca892a76a0216af28256ba5a93dbe5e8e060356d9"}
{"level":"info","ts":"2026-07-08T21:48:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0e2113ac80d7650582a092eca892a76a0216af28256ba5a93dbe5e8e060356d9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T21:48:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"cd3683d92f223e9e9c945cb1d4303f74bbf05a57822c225d08cb0cac9c7dfae1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-08T21:48:24Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-08T21:48:24Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["cd3683d92f223e9e9c945cb1d4303f74bbf05a57822c225d08cb0cac9c7dfae1"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-08T21:48:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/63900473334735a68ffa3164fef3b6a2368e3d36ca04361533f1f52f385d1d8c"}
{"level":"info","ts":"2026-07-08T21:48:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"cd3683d92f223e9e9c945cb1d4303f74bbf05a57822c225d08cb0cac9c7dfae1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T21:48:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"63900473334735a68ffa3164fef3b6a2368e3d36ca04361533f1f52f385d1d8c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T21:48:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0e2113ac80d7650582a092eca892a76a0216af28256ba5a93dbe5e8e060356d9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T21:48:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cd3683d92f223e9e9c945cb1d4303f74bbf05a57822c225d08cb0cac9c7dfae1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T21:48:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0e2113ac80d7650582a092eca892a76a0216af28256ba5a93dbe5e8e060356d9","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-08T21:48:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0e2113ac80d7650582a092eca892a76a0216af28256ba5a93dbe5e8e060356d9"}
{"level":"debug","ts":"2026-07-08T21:48:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"29d8e05e17bf2aa52311ba9f2aa2b8f708ea0a3a214bd3afc91ee27b4cbbb4ce","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-08T21:48:24Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-08T21:48:24Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-08T21:48:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cd3683d92f223e9e9c945cb1d4303f74bbf05a57822c225d08cb0cac9c7dfae1"}
{"level":"info","ts":"2026-07-08T21:48:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"29d8e05e17bf2aa52311ba9f2aa2b8f708ea0a3a214bd3afc91ee27b4cbbb4ce","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T21:48:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"29d8e05e17bf2aa52311ba9f2aa2b8f708ea0a3a214bd3afc91ee27b4cbbb4ce","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-08T21:48:24Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-08T21:48:24Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-08T21:48:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/29d8e05e17bf2aa52311ba9f2aa2b8f708ea0a3a214bd3afc91ee27b4cbbb4ce"}
{"level":"info","ts":"2026-07-08T21:48:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"29d8e05e17bf2aa52311ba9f2aa2b8f708ea0a3a214bd3afc91ee27b4cbbb4ce","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T21:48:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0e2113ac80d7650582a092eca892a76a0216af28256ba5a93dbe5e8e060356d9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-08T21:48:24Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-08T21:48:24Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["0e2113ac80d7650582a092eca892a76a0216af28256ba5a93dbe5e8e060356d9"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-08T21:48:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0e2113ac80d7650582a092eca892a76a0216af28256ba5a93dbe5e8e060356d9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T21:48:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"29d8e05e17bf2aa52311ba9f2aa2b8f708ea0a3a214bd3afc91ee27b4cbbb4ce","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T21:48:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0e2113ac80d7650582a092eca892a76a0216af28256ba5a93dbe5e8e060356d9","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-08T21:48:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/29d8e05e17bf2aa52311ba9f2aa2b8f708ea0a3a214bd3afc91ee27b4cbbb4ce"}
{"level":"debug","ts":"2026-07-08T21:48:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"29d8e05e17bf2aa52311ba9f2aa2b8f708ea0a3a214bd3afc91ee27b4cbbb4ce","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-08T21:48:25Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-08T21:48:25Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["29d8e05e17bf2aa52311ba9f2aa2b8f708ea0a3a214bd3afc91ee27b4cbbb4ce"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-08T21:48:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0e2113ac80d7650582a092eca892a76a0216af28256ba5a93dbe5e8e060356d9"}
{"level":"info","ts":"2026-07-08T21:48:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"29d8e05e17bf2aa52311ba9f2aa2b8f708ea0a3a214bd3afc91ee27b4cbbb4ce","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T21:48:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"29d8e05e17bf2aa52311ba9f2aa2b8f708ea0a3a214bd3afc91ee27b4cbbb4ce","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-08T21:48:25Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-08T21:48:25Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-08T21:48:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"29d8e05e17bf2aa52311ba9f2aa2b8f708ea0a3a214bd3afc91ee27b4cbbb4ce","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T21:48:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"29d8e05e17bf2aa52311ba9f2aa2b8f708ea0a3a214bd3afc91ee27b4cbbb4ce","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-08T21:48:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/29d8e05e17bf2aa52311ba9f2aa2b8f708ea0a3a214bd3afc91ee27b4cbbb4ce"}
{"level":"debug","ts":"2026-07-08T21:48:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"29d8e05e17bf2aa52311ba9f2aa2b8f708ea0a3a214bd3afc91ee27b4cbbb4ce","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-08T21:48:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/29d8e05e17bf2aa52311ba9f2aa2b8f708ea0a3a214bd3afc91ee27b4cbbb4ce"}
{"level":"debug","ts":"2026-07-08T21:48:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"29d8e05e17bf2aa52311ba9f2aa2b8f708ea0a3a214bd3afc91ee27b4cbbb4ce","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-08T21:48:25Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-08T21:48:25Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["29d8e05e17bf2aa52311ba9f2aa2b8f708ea0a3a214bd3afc91ee27b4cbbb4ce"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-08T21:48:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"29d8e05e17bf2aa52311ba9f2aa2b8f708ea0a3a214bd3afc91ee27b4cbbb4ce","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T21:48:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"29d8e05e17bf2aa52311ba9f2aa2b8f708ea0a3a214bd3afc91ee27b4cbbb4ce","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-08T21:48:25Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-08T21:48:25Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-08T21:48:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"29d8e05e17bf2aa52311ba9f2aa2b8f708ea0a3a214bd3afc91ee27b4cbbb4ce","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T21:48:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"29d8e05e17bf2aa52311ba9f2aa2b8f708ea0a3a214bd3afc91ee27b4cbbb4ce","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T21:48:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"29d8e05e17bf2aa52311ba9f2aa2b8f708ea0a3a214bd3afc91ee27b4cbbb4ce","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-08T21:48:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/29d8e05e17bf2aa52311ba9f2aa2b8f708ea0a3a214bd3afc91ee27b4cbbb4ce"}
{"level":"debug","ts":"2026-07-08T21:48:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"29d8e05e17bf2aa52311ba9f2aa2b8f708ea0a3a214bd3afc91ee27b4cbbb4ce","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-08T21:48:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/29d8e05e17bf2aa52311ba9f2aa2b8f708ea0a3a214bd3afc91ee27b4cbbb4ce"}
{"level":"debug","ts":"2026-07-08T21:48:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"677abf60d9019db2f024f7d302325636f91831a983506e03e8dd3255eff9c427","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-08T21:48:25Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-08T21:48:25Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-08T21:48:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"677abf60d9019db2f024f7d302325636f91831a983506e03e8dd3255eff9c427","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T21:48:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"29d8e05e17bf2aa52311ba9f2aa2b8f708ea0a3a214bd3afc91ee27b4cbbb4ce","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-08T21:48:25Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-08T21:48:25Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["29d8e05e17bf2aa52311ba9f2aa2b8f708ea0a3a214bd3afc91ee27b4cbbb4ce"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-08T21:48:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/677abf60d9019db2f024f7d302325636f91831a983506e03e8dd3255eff9c427"}
{"level":"info","ts":"2026-07-08T21:48:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"29d8e05e17bf2aa52311ba9f2aa2b8f708ea0a3a214bd3afc91ee27b4cbbb4ce","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T21:48:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"677abf60d9019db2f024f7d302325636f91831a983506e03e8dd3255eff9c427","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-08T21:48:25Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-08T21:48:25Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-08T21:48:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"677abf60d9019db2f024f7d302325636f91831a983506e03e8dd3255eff9c427","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T21:48:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"29d8e05e17bf2aa52311ba9f2aa2b8f708ea0a3a214bd3afc91ee27b4cbbb4ce","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T21:48:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"677abf60d9019db2f024f7d302325636f91831a983506e03e8dd3255eff9c427","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-08T21:48:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/677abf60d9019db2f024f7d302325636f91831a983506e03e8dd3255eff9c427"}
{"level":"debug","ts":"2026-07-08T21:48:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"677abf60d9019db2f024f7d302325636f91831a983506e03e8dd3255eff9c427","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-08T21:48:25Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-08T21:48:25Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["677abf60d9019db2f024f7d302325636f91831a983506e03e8dd3255eff9c427"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-08T21:48:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"677abf60d9019db2f024f7d302325636f91831a983506e03e8dd3255eff9c427","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T21:48:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"677abf60d9019db2f024f7d302325636f91831a983506e03e8dd3255eff9c427","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-08T21:48:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/29d8e05e17bf2aa52311ba9f2aa2b8f708ea0a3a214bd3afc91ee27b4cbbb4ce"}
{"level":"info","ts":"2026-07-08T21:48:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/677abf60d9019db2f024f7d302325636f91831a983506e03e8dd3255eff9c427"}
{"level":"debug","ts":"2026-07-08T21:48:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1ca1694823f5deda8e00acee784a19bc752890c3b80e577192c6444e2b353fd7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-08T21:48:25Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-08T21:48:25Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-08T21:48:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1ca1694823f5deda8e00acee784a19bc752890c3b80e577192c6444e2b353fd7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T21:48:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1ca1694823f5deda8e00acee784a19bc752890c3b80e577192c6444e2b353fd7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T21:48:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1ca1694823f5deda8e00acee784a19bc752890c3b80e577192c6444e2b353fd7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-08T21:48:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1ca1694823f5deda8e00acee784a19bc752890c3b80e577192c6444e2b353fd7"}
{"level":"debug","ts":"2026-07-08T21:48:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1ca1694823f5deda8e00acee784a19bc752890c3b80e577192c6444e2b353fd7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-08T21:48:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1ca1694823f5deda8e00acee784a19bc752890c3b80e577192c6444e2b353fd7"}
{"level":"debug","ts":"2026-07-08T21:48:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1ca1694823f5deda8e00acee784a19bc752890c3b80e577192c6444e2b353fd7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-08T21:48:25Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-08T21:48:25Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1ca1694823f5deda8e00acee784a19bc752890c3b80e577192c6444e2b353fd7"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-08T21:48:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1ca1694823f5deda8e00acee784a19bc752890c3b80e577192c6444e2b353fd7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T21:48:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1ca1694823f5deda8e00acee784a19bc752890c3b80e577192c6444e2b353fd7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T21:48:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0745863b456447e558a4a53ee4add4485fa8ff437454caa8e33542e7a59a9a72","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-08T21:48:25Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-08T21:48:25Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-08T21:48:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0745863b456447e558a4a53ee4add4485fa8ff437454caa8e33542e7a59a9a72","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T21:48:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0745863b456447e558a4a53ee4add4485fa8ff437454caa8e33542e7a59a9a72","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-08T21:48:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1ca1694823f5deda8e00acee784a19bc752890c3b80e577192c6444e2b353fd7"}
{"level":"debug","ts":"2026-07-08T21:48:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0745863b456447e558a4a53ee4add4485fa8ff437454caa8e33542e7a59a9a72","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-08T21:48:25Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-08T21:48:25Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-08T21:48:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0745863b456447e558a4a53ee4add4485fa8ff437454caa8e33542e7a59a9a72"}
{"level":"info","ts":"2026-07-08T21:48:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0745863b456447e558a4a53ee4add4485fa8ff437454caa8e33542e7a59a9a72","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T21:48:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0745863b456447e558a4a53ee4add4485fa8ff437454caa8e33542e7a59a9a72","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T21:48:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0745863b456447e558a4a53ee4add4485fa8ff437454caa8e33542e7a59a9a72","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-08T21:48:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0745863b456447e558a4a53ee4add4485fa8ff437454caa8e33542e7a59a9a72"}
{"level":"debug","ts":"2026-07-08T21:48:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0745863b456447e558a4a53ee4add4485fa8ff437454caa8e33542e7a59a9a72","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-08T21:48:25Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-08T21:48:25Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["0745863b456447e558a4a53ee4add4485fa8ff437454caa8e33542e7a59a9a72"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-08T21:48:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0745863b456447e558a4a53ee4add4485fa8ff437454caa8e33542e7a59a9a72","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T21:48:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0745863b456447e558a4a53ee4add4485fa8ff437454caa8e33542e7a59a9a72","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-08T21:48:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0745863b456447e558a4a53ee4add4485fa8ff437454caa8e33542e7a59a9a72"}
{"level":"debug","ts":"2026-07-08T21:48:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"cd3683d92f223e9e9c945cb1d4303f74bbf05a57822c225d08cb0cac9c7dfae1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-08T21:48:44Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-08T21:48:44Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-08T21:48:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"cd3683d92f223e9e9c945cb1d4303f74bbf05a57822c225d08cb0cac9c7dfae1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T21:48:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cd3683d92f223e9e9c945cb1d4303f74bbf05a57822c225d08cb0cac9c7dfae1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T21:48:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cd3683d92f223e9e9c945cb1d4303f74bbf05a57822c225d08cb0cac9c7dfae1","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-08T21:48:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cd3683d92f223e9e9c945cb1d4303f74bbf05a57822c225d08cb0cac9c7dfae1"}
{"level":"debug","ts":"2026-07-08T21:48:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cd3683d92f223e9e9c945cb1d4303f74bbf05a57822c225d08cb0cac9c7dfae1","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-08T21:48:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cd3683d92f223e9e9c945cb1d4303f74bbf05a57822c225d08cb0cac9c7dfae1"}
{"level":"debug","ts":"2026-07-08T21:48:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"cd3683d92f223e9e9c945cb1d4303f74bbf05a57822c225d08cb0cac9c7dfae1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-08T21:48:44Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-08T21:48:44Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["cd3683d92f223e9e9c945cb1d4303f74bbf05a57822c225d08cb0cac9c7dfae1"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-08T21:48:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"cd3683d92f223e9e9c945cb1d4303f74bbf05a57822c225d08cb0cac9c7dfae1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T21:48:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"cd3683d92f223e9e9c945cb1d4303f74bbf05a57822c225d08cb0cac9c7dfae1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-08T21:48:44Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-08T21:48:44Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-08T21:48:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"cd3683d92f223e9e9c945cb1d4303f74bbf05a57822c225d08cb0cac9c7dfae1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T21:48:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cd3683d92f223e9e9c945cb1d4303f74bbf05a57822c225d08cb0cac9c7dfae1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T21:48:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cd3683d92f223e9e9c945cb1d4303f74bbf05a57822c225d08cb0cac9c7dfae1","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-08T21:48:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cd3683d92f223e9e9c945cb1d4303f74bbf05a57822c225d08cb0cac9c7dfae1"}
{"level":"debug","ts":"2026-07-08T21:48:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cd3683d92f223e9e9c945cb1d4303f74bbf05a57822c225d08cb0cac9c7dfae1","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-08T21:48:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cd3683d92f223e9e9c945cb1d4303f74bbf05a57822c225d08cb0cac9c7dfae1"}
{"level":"debug","ts":"2026-07-08T21:48:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"cd3683d92f223e9e9c945cb1d4303f74bbf05a57822c225d08cb0cac9c7dfae1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-08T21:48:44Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-08T21:48:44Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["cd3683d92f223e9e9c945cb1d4303f74bbf05a57822c225d08cb0cac9c7dfae1"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-08T21:48:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"cd3683d92f223e9e9c945cb1d4303f74bbf05a57822c225d08cb0cac9c7dfae1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T21:48:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cd3683d92f223e9e9c945cb1d4303f74bbf05a57822c225d08cb0cac9c7dfae1","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-08T21:48:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cd3683d92f223e9e9c945cb1d4303f74bbf05a57822c225d08cb0cac9c7dfae1"}
{"level":"debug","ts":"2026-07-08T21:48:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"29d8e05e17bf2aa52311ba9f2aa2b8f708ea0a3a214bd3afc91ee27b4cbbb4ce","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-08T21:48:44Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-08T21:48:44Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-08T21:48:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"29d8e05e17bf2aa52311ba9f2aa2b8f708ea0a3a214bd3afc91ee27b4cbbb4ce","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T21:48:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"29d8e05e17bf2aa52311ba9f2aa2b8f708ea0a3a214bd3afc91ee27b4cbbb4ce","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T21:48:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"29d8e05e17bf2aa52311ba9f2aa2b8f708ea0a3a214bd3afc91ee27b4cbbb4ce","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-08T21:48:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/29d8e05e17bf2aa52311ba9f2aa2b8f708ea0a3a214bd3afc91ee27b4cbbb4ce"}
{"level":"debug","ts":"2026-07-08T21:48:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"29d8e05e17bf2aa52311ba9f2aa2b8f708ea0a3a214bd3afc91ee27b4cbbb4ce","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-08T21:48:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/29d8e05e17bf2aa52311ba9f2aa2b8f708ea0a3a214bd3afc91ee27b4cbbb4ce"}
{"level":"debug","ts":"2026-07-08T21:48:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"29d8e05e17bf2aa52311ba9f2aa2b8f708ea0a3a214bd3afc91ee27b4cbbb4ce","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-08T21:48:44Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-08T21:48:44Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["29d8e05e17bf2aa52311ba9f2aa2b8f708ea0a3a214bd3afc91ee27b4cbbb4ce"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-08T21:48:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"29d8e05e17bf2aa52311ba9f2aa2b8f708ea0a3a214bd3afc91ee27b4cbbb4ce","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T21:48:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"29d8e05e17bf2aa52311ba9f2aa2b8f708ea0a3a214bd3afc91ee27b4cbbb4ce","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T21:48:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"74f990853dc8a280afcc78b4bda00bb6954e86e746eecac2bbb04478e4b65ae3","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-08T21:48:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/29d8e05e17bf2aa52311ba9f2aa2b8f708ea0a3a214bd3afc91ee27b4cbbb4ce"}
{"level":"info","ts":"2026-07-08T21:48:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/74f990853dc8a280afcc78b4bda00bb6954e86e746eecac2bbb04478e4b65ae3"}
{"level":"debug","ts":"2026-07-08T21:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dd08ee968d5b6b4ba9721913819e630146179e1d9e5f3b7a4dffd6c2fc1c1574","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-08T21:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dd08ee968d5b6b4ba9721913819e630146179e1d9e5f3b7a4dffd6c2fc1c1574"}
{"level":"debug","ts":"2026-07-08T21:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"28bf2da0dfa3cf38dd67bc20ea0f0128dae7b178e6ceeaf8c61ee4ae9a379d9b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T21:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b38353481c388254a93bb2d85ca21ef7d2625b5783885841f70964ed2e16c209","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-08T21:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/28bf2da0dfa3cf38dd67bc20ea0f0128dae7b178e6ceeaf8c61ee4ae9a379d9b"}
{"level":"info","ts":"2026-07-08T21:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b38353481c388254a93bb2d85ca21ef7d2625b5783885841f70964ed2e16c209"}
{"level":"debug","ts":"2026-07-08T21:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"407bd59a62ce77cec81f4a4d17a9a1e36300cd7f093fc62470d14e255ce17718","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-08T21:48:45Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-08T21:48:45Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-08T21:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"407bd59a62ce77cec81f4a4d17a9a1e36300cd7f093fc62470d14e255ce17718","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T21:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"407bd59a62ce77cec81f4a4d17a9a1e36300cd7f093fc62470d14e255ce17718","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T21:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"407bd59a62ce77cec81f4a4d17a9a1e36300cd7f093fc62470d14e255ce17718","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-08T21:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/407bd59a62ce77cec81f4a4d17a9a1e36300cd7f093fc62470d14e255ce17718"}
{"level":"debug","ts":"2026-07-08T21:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"407bd59a62ce77cec81f4a4d17a9a1e36300cd7f093fc62470d14e255ce17718","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-08T21:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/407bd59a62ce77cec81f4a4d17a9a1e36300cd7f093fc62470d14e255ce17718"}
{"level":"debug","ts":"2026-07-08T21:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"407bd59a62ce77cec81f4a4d17a9a1e36300cd7f093fc62470d14e255ce17718","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-08T21:48:45Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-08T21:48:45Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["407bd59a62ce77cec81f4a4d17a9a1e36300cd7f093fc62470d14e255ce17718"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-08T21:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"407bd59a62ce77cec81f4a4d17a9a1e36300cd7f093fc62470d14e255ce17718","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T21:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"407bd59a62ce77cec81f4a4d17a9a1e36300cd7f093fc62470d14e255ce17718","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-08T21:48:45Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-08T21:48:45Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-08T21:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"407bd59a62ce77cec81f4a4d17a9a1e36300cd7f093fc62470d14e255ce17718","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T21:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0e2113ac80d7650582a092eca892a76a0216af28256ba5a93dbe5e8e060356d9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T21:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"407bd59a62ce77cec81f4a4d17a9a1e36300cd7f093fc62470d14e255ce17718","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T21:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"407bd59a62ce77cec81f4a4d17a9a1e36300cd7f093fc62470d14e255ce17718","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-08T21:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/407bd59a62ce77cec81f4a4d17a9a1e36300cd7f093fc62470d14e255ce17718"}
{"level":"debug","ts":"2026-07-08T21:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"407bd59a62ce77cec81f4a4d17a9a1e36300cd7f093fc62470d14e255ce17718","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-08T21:48:45Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-08T21:48:45Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["407bd59a62ce77cec81f4a4d17a9a1e36300cd7f093fc62470d14e255ce17718"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-08T21:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0e2113ac80d7650582a092eca892a76a0216af28256ba5a93dbe5e8e060356d9"}
{"level":"info","ts":"2026-07-08T21:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"407bd59a62ce77cec81f4a4d17a9a1e36300cd7f093fc62470d14e255ce17718","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T21:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"407bd59a62ce77cec81f4a4d17a9a1e36300cd7f093fc62470d14e255ce17718","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-08T21:48:45Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-08T21:48:45Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-08T21:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/407bd59a62ce77cec81f4a4d17a9a1e36300cd7f093fc62470d14e255ce17718"}
{"level":"info","ts":"2026-07-08T21:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"407bd59a62ce77cec81f4a4d17a9a1e36300cd7f093fc62470d14e255ce17718","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T21:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"407bd59a62ce77cec81f4a4d17a9a1e36300cd7f093fc62470d14e255ce17718","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T21:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"407bd59a62ce77cec81f4a4d17a9a1e36300cd7f093fc62470d14e255ce17718","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-08T21:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/407bd59a62ce77cec81f4a4d17a9a1e36300cd7f093fc62470d14e255ce17718"}
{"level":"debug","ts":"2026-07-08T21:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"407bd59a62ce77cec81f4a4d17a9a1e36300cd7f093fc62470d14e255ce17718","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T21:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3c80761d470cba66be83dd79aebc6da99105be485f578e77b7d309591637371d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-08T21:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/407bd59a62ce77cec81f4a4d17a9a1e36300cd7f093fc62470d14e255ce17718"}
{"level":"debug","ts":"2026-07-08T21:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3566755a74bdf005c22036058ecb149b4921d09fd85759462e1e5bb04495887e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-08T21:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3c80761d470cba66be83dd79aebc6da99105be485f578e77b7d309591637371d"}
{"level":"debug","ts":"2026-07-08T21:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"407bd59a62ce77cec81f4a4d17a9a1e36300cd7f093fc62470d14e255ce17718","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-08T21:48:45Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-08T21:48:45Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["407bd59a62ce77cec81f4a4d17a9a1e36300cd7f093fc62470d14e255ce17718"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-08T21:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"407bd59a62ce77cec81f4a4d17a9a1e36300cd7f093fc62470d14e255ce17718","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T21:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fb3ee0616b923606ea609c87234346b85d41cbbb7db3809e14f4c561c6542bbd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T21:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"407bd59a62ce77cec81f4a4d17a9a1e36300cd7f093fc62470d14e255ce17718","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-08T21:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3566755a74bdf005c22036058ecb149b4921d09fd85759462e1e5bb04495887e"}
{"level":"debug","ts":"2026-07-08T21:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"80a90b8e76d0ecb65ccc8b90421f826ebb06e42b00c2506645e850f9a1695e68","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-08T21:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fb3ee0616b923606ea609c87234346b85d41cbbb7db3809e14f4c561c6542bbd"}
{"level":"info","ts":"2026-07-08T21:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/407bd59a62ce77cec81f4a4d17a9a1e36300cd7f093fc62470d14e255ce17718"}
{"level":"debug","ts":"2026-07-08T21:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"63900473334735a68ffa3164fef3b6a2368e3d36ca04361533f1f52f385d1d8c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T21:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1ca1694823f5deda8e00acee784a19bc752890c3b80e577192c6444e2b353fd7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-08T21:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/80a90b8e76d0ecb65ccc8b90421f826ebb06e42b00c2506645e850f9a1695e68"}
{"level":"debug","ts":"2026-07-08T21:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c26f474283304837eeac69681b91dccbf8c7415e4c587eaf20dee19ffac27b5b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-08T21:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/63900473334735a68ffa3164fef3b6a2368e3d36ca04361533f1f52f385d1d8c"}
{"level":"info","ts":"2026-07-08T21:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1ca1694823f5deda8e00acee784a19bc752890c3b80e577192c6444e2b353fd7"}
{"level":"info","ts":"2026-07-08T21:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c26f474283304837eeac69681b91dccbf8c7415e4c587eaf20dee19ffac27b5b"}
{"level":"debug","ts":"2026-07-08T21:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"601fa04d111a25234a8148e51d6d734fb7c307e259718911efe3e1705a809f98","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-08T21:48:45Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-08T21:48:45Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-08T21:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"601fa04d111a25234a8148e51d6d734fb7c307e259718911efe3e1705a809f98","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T21:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"601fa04d111a25234a8148e51d6d734fb7c307e259718911efe3e1705a809f98","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T21:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b129d5e6efbc7625e8756cf278870a82fa832d7456bea97fc3519b283490bdce","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T21:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"601fa04d111a25234a8148e51d6d734fb7c307e259718911efe3e1705a809f98","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-08T21:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/601fa04d111a25234a8148e51d6d734fb7c307e259718911efe3e1705a809f98"}
{"level":"debug","ts":"2026-07-08T21:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0745863b456447e558a4a53ee4add4485fa8ff437454caa8e33542e7a59a9a72","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T21:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"601fa04d111a25234a8148e51d6d734fb7c307e259718911efe3e1705a809f98","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-08T21:48:45Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-08T21:48:45Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["601fa04d111a25234a8148e51d6d734fb7c307e259718911efe3e1705a809f98"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-08T21:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b129d5e6efbc7625e8756cf278870a82fa832d7456bea97fc3519b283490bdce"}
{"level":"info","ts":"2026-07-08T21:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"601fa04d111a25234a8148e51d6d734fb7c307e259718911efe3e1705a809f98","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T21:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0f55d82994fba5e63a0ce11c062f22c55f990b39c302e51b48b2ce098647f297","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T21:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"601fa04d111a25234a8148e51d6d734fb7c307e259718911efe3e1705a809f98","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-08T21:48:45Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-08T21:48:45Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-08T21:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"601fa04d111a25234a8148e51d6d734fb7c307e259718911efe3e1705a809f98","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T21:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"677abf60d9019db2f024f7d302325636f91831a983506e03e8dd3255eff9c427","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T21:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"601fa04d111a25234a8148e51d6d734fb7c307e259718911efe3e1705a809f98","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-08T21:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/601fa04d111a25234a8148e51d6d734fb7c307e259718911efe3e1705a809f98"}
{"level":"debug","ts":"2026-07-08T21:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"601fa04d111a25234a8148e51d6d734fb7c307e259718911efe3e1705a809f98","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-08T21:48:45Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-08T21:48:45Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["601fa04d111a25234a8148e51d6d734fb7c307e259718911efe3e1705a809f98"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-08T21:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"601fa04d111a25234a8148e51d6d734fb7c307e259718911efe3e1705a809f98","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T21:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"601fa04d111a25234a8148e51d6d734fb7c307e259718911efe3e1705a809f98","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-08T21:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0745863b456447e558a4a53ee4add4485fa8ff437454caa8e33542e7a59a9a72"}
{"level":"debug","ts":"2026-07-08T21:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"75f96ff5e489bdca0150c4c75717a6fe8fd4c16a613ddfa524a8da7c70ca0f53","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-08T21:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0f55d82994fba5e63a0ce11c062f22c55f990b39c302e51b48b2ce098647f297"}
{"level":"debug","ts":"2026-07-08T21:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f2d1d29da451966389403278ffce45dc232693e39f4042eb27a8cc19dca79574","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T21:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9e6ed0b779b4e60c924bb81dba908ed945d89646ab3f5d68720479bed1bf0c4d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-08T21:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/677abf60d9019db2f024f7d302325636f91831a983506e03e8dd3255eff9c427"}
{"level":"debug","ts":"2026-07-08T21:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9b43e0e1075c6422f6320fbb27346fa374aaca552536d337f7b697e2dc1c7b2b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-08T21:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/601fa04d111a25234a8148e51d6d734fb7c307e259718911efe3e1705a809f98"}
{"level":"info","ts":"2026-07-08T21:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/75f96ff5e489bdca0150c4c75717a6fe8fd4c16a613ddfa524a8da7c70ca0f53"}
{"level":"info","ts":"2026-07-08T21:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f2d1d29da451966389403278ffce45dc232693e39f4042eb27a8cc19dca79574"}
{"level":"info","ts":"2026-07-08T21:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9e6ed0b779b4e60c924bb81dba908ed945d89646ab3f5d68720479bed1bf0c4d"}
{"level":"info","ts":"2026-07-08T21:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9b43e0e1075c6422f6320fbb27346fa374aaca552536d337f7b697e2dc1c7b2b"}
{"level":"info","ts":"2026-07-08T21:48:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a0c52026-8bf8-4be8-82dc-3cfb618c4d9f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:38966","PortSpecifier":{"PortValue":38966}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a0c52026-8bf8-4be8-82dc-3cfb618c4d9f","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-fbb91c.apps.28969351-50a3-4a4b-8c99-c3afd5ef9186.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-08T21:48:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a0c52026-8bf8-4be8-82dc-3cfb618c4d9f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:38966","PortSpecifier":{"PortValue":38966}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783547329,"nanos":538534635},"http":{"id":"a0c52026-8bf8-4be8-82dc-3cfb618c4d9f","method":"POST","headers":{":authority":"e2e-shared-a-fbb91c.apps.28969351-50a3-4a4b-8c99-c3afd5ef9186.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-08T21:48:49Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"a0c52026-8bf8-4be8-82dc-3cfb618c4d9f","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-08T21:48:49Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a0c52026-8bf8-4be8-82dc-3cfb618c4d9f","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"e150623e-58ce-4428-b91c-a74051e277ae","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=7198852e-234f-44f5-a80d-330ce4ef59ba"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/c3afd5ef9186"]}}
{"level":"debug","ts":"2026-07-08T21:48:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a0c52026-8bf8-4be8-82dc-3cfb618c4d9f","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/c3afd5ef9186"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=7198852e-234f-44f5-a80d-330ce4ef59ba"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"e150623e-58ce-4428-b91c-a74051e277ae","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"74f990853dc8a280afcc78b4bda00bb6954e86e746eecac2bbb04478e4b65ae3"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.52:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-fbb91c.apps.28969351-50a3-4a4b-8c99-c3afd5ef9186.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-08T21:48:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a0c52026-8bf8-4be8-82dc-3cfb618c4d9f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T21:48:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a0c52026-8bf8-4be8-82dc-3cfb618c4d9f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T21:48:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a0c52026-8bf8-4be8-82dc-3cfb618c4d9f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-fbb91c/rate-test-model-fbb91c\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T21:48:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"a0c52026-8bf8-4be8-82dc-3cfb618c4d9f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-08T21:48:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a0c52026-8bf8-4be8-82dc-3cfb618c4d9f","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-08T21:48:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a0c52026-8bf8-4be8-82dc-3cfb618c4d9f","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-08T21:48:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a0c52026-8bf8-4be8-82dc-3cfb618c4d9f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-08T21:48:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a0c52026-8bf8-4be8-82dc-3cfb618c4d9f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-08T21:48:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"dd86255c-df43-431a-bac3-c4c5878ff7eb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:45406","PortSpecifier":{"PortValue":45406}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"dd86255c-df43-431a-bac3-c4c5878ff7eb","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-6edaf8.apps.28969351-50a3-4a4b-8c99-c3afd5ef9186.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-08T21:48:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"dd86255c-df43-431a-bac3-c4c5878ff7eb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:45406","PortSpecifier":{"PortValue":45406}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783547329,"nanos":581712102},"http":{"id":"dd86255c-df43-431a-bac3-c4c5878ff7eb","method":"POST","headers":{":authority":"e2e-shared-b-6edaf8.apps.28969351-50a3-4a4b-8c99-c3afd5ef9186.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-08T21:48:49Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"dd86255c-df43-431a-bac3-c4c5878ff7eb","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-08T21:48:49Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"dd86255c-df43-431a-bac3-c4c5878ff7eb","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"e150623e-58ce-4428-b91c-a74051e277ae","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=7198852e-234f-44f5-a80d-330ce4ef59ba"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/c3afd5ef9186"]}}
{"level":"debug","ts":"2026-07-08T21:48:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"dd86255c-df43-431a-bac3-c4c5878ff7eb","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/c3afd5ef9186"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=7198852e-234f-44f5-a80d-330ce4ef59ba"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"e150623e-58ce-4428-b91c-a74051e277ae","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"75f96ff5e489bdca0150c4c75717a6fe8fd4c16a613ddfa524a8da7c70ca0f53"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.54:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-6edaf8.apps.28969351-50a3-4a4b-8c99-c3afd5ef9186.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-08T21:48:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dd86255c-df43-431a-bac3-c4c5878ff7eb","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T21:48:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dd86255c-df43-431a-bac3-c4c5878ff7eb","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T21:48:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dd86255c-df43-431a-bac3-c4c5878ff7eb","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-6edaf8/rate-test-model-6edaf8\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T21:48:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"dd86255c-df43-431a-bac3-c4c5878ff7eb","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-08T21:48:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dd86255c-df43-431a-bac3-c4c5878ff7eb","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-08T21:48:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dd86255c-df43-431a-bac3-c4c5878ff7eb","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-08T21:48:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"dd86255c-df43-431a-bac3-c4c5878ff7eb","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-08T21:48:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"dd86255c-df43-431a-bac3-c4c5878ff7eb","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-08T21:48:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1d5c5717-343b-4018-bece-c1d1b8e7d4ff","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:38972","PortSpecifier":{"PortValue":38972}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1d5c5717-343b-4018-bece-c1d1b8e7d4ff","method":"POST","path":"/ai-tenant-e2e-shared-a-fbb91c/rate-test-model-fbb91c/v1/completions","host":"e2e-shared-a-fbb91c.apps.28969351-50a3-4a4b-8c99-c3afd5ef9186.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-08T21:48:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1d5c5717-343b-4018-bece-c1d1b8e7d4ff","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:38972","PortSpecifier":{"PortValue":38972}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783547329,"nanos":625300393},"http":{"id":"1d5c5717-343b-4018-bece-c1d1b8e7d4ff","method":"POST","headers":{":authority":"e2e-shared-a-fbb91c.apps.28969351-50a3-4a4b-8c99-c3afd5ef9186.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-fbb91c/rate-test-model-fbb91c/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-08T21:48:49Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1d5c5717-343b-4018-bece-c1d1b8e7d4ff","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1R0DMlRLQ8TKbzTOU_RJxMEakgR9SQeHql3WTpIOm92KouLZHLMKw2vWzyjWN"}
{"level":"debug","ts":"2026-07-08T21:48:49Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1d5c5717-343b-4018-bece-c1d1b8e7d4ff","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-fbb91c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1R0DMlRLQ8TKbzTOU_RJxMEakgR9SQeHql3WTpIOm92KouLZHLMKw2vWzyjWN\"}"}
{"level":"debug","ts":"2026-07-08T21:48:49Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1d5c5717-343b-4018-bece-c1d1b8e7d4ff","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-fbb91c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"8df301e8-4f76-48ae-b1c8-146c1d3ddb49","keyName":"e2e-rate-a-581023","subscription":"e2e-rate-iso-a-581023","tenant":"e2e-shared-a-fbb91c","userId":"8df301e8-4f76-48ae-b1c8-146c1d3ddb49","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-08T21:48:49Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1d5c5717-343b-4018-bece-c1d1b8e7d4ff","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-fbb91c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-fbb91c/rate-test-model-fbb91c\",\"requestedSubscription\":\"e2e-rate-iso-a-581023\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-08T21:48:49Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1d5c5717-343b-4018-bece-c1d1b8e7d4ff","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-fbb91c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-fbb91c","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-581023","namespace":"ai-tenant-e2e-shared-a-fbb91c","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-08T21:48:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1d5c5717-343b-4018-bece-c1d1b8e7d4ff","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-08T21:48:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1d5c5717-343b-4018-bece-c1d1b8e7d4ff","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T21:48:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1d5c5717-343b-4018-bece-c1d1b8e7d4ff","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T21:48:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1d5c5717-343b-4018-bece-c1d1b8e7d4ff","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T21:48:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1d5c5717-343b-4018-bece-c1d1b8e7d4ff","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-fbb91c/rate-test-model-fbb91c\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T21:48:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1d5c5717-343b-4018-bece-c1d1b8e7d4ff","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-581023"}
{"level":"debug","ts":"2026-07-08T21:48:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1d5c5717-343b-4018-bece-c1d1b8e7d4ff","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-08T21:48:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1d5c5717-343b-4018-bece-c1d1b8e7d4ff","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-08T21:48:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1d5c5717-343b-4018-bece-c1d1b8e7d4ff","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"8df301e8-4f76-48ae-b1c8-146c1d3ddb49","keyName":"e2e-rate-a-581023","selected_subscription":"e2e-rate-iso-a-581023","selected_subscription_key":"ai-tenant-e2e-shared-a-fbb91c/e2e-rate-iso-a-581023@ai-tenant-e2e-shared-a-fbb91c/rate-test-model-fbb91c","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-fbb91c","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-581023","namespace":"ai-tenant-e2e-shared-a-fbb91c","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-08T21:48:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1d5c5717-343b-4018-bece-c1d1b8e7d4ff","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-08T21:48:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1d5c5717-343b-4018-bece-c1d1b8e7d4ff","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-08T21:48:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"12198ac7-69e3-4e57-a21b-1b3525a0f044","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:37802","PortSpecifier":{"PortValue":37802}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"12198ac7-69e3-4e57-a21b-1b3525a0f044","method":"POST","path":"/ai-tenant-e2e-shared-a-fbb91c/rate-test-model-fbb91c/v1/completions","host":"e2e-shared-a-fbb91c.apps.28969351-50a3-4a4b-8c99-c3afd5ef9186.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-08T21:48:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"12198ac7-69e3-4e57-a21b-1b3525a0f044","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:37802","PortSpecifier":{"PortValue":37802}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783547330,"nanos":682359603},"http":{"id":"12198ac7-69e3-4e57-a21b-1b3525a0f044","method":"POST","headers":{":authority":"e2e-shared-a-fbb91c.apps.28969351-50a3-4a4b-8c99-c3afd5ef9186.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-fbb91c/rate-test-model-fbb91c/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-08T21:48:50Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"12198ac7-69e3-4e57-a21b-1b3525a0f044","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1R0DMlRLQ8TKbzTOU_RJxMEakgR9SQeHql3WTpIOm92KouLZHLMKw2vWzyjWN"}
{"level":"debug","ts":"2026-07-08T21:48:50Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"12198ac7-69e3-4e57-a21b-1b3525a0f044","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-fbb91c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1R0DMlRLQ8TKbzTOU_RJxMEakgR9SQeHql3WTpIOm92KouLZHLMKw2vWzyjWN\"}"}
{"level":"debug","ts":"2026-07-08T21:48:50Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"12198ac7-69e3-4e57-a21b-1b3525a0f044","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-fbb91c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"8df301e8-4f76-48ae-b1c8-146c1d3ddb49","keyName":"e2e-rate-a-581023","subscription":"e2e-rate-iso-a-581023","tenant":"e2e-shared-a-fbb91c","userId":"8df301e8-4f76-48ae-b1c8-146c1d3ddb49","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-08T21:48:50Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"12198ac7-69e3-4e57-a21b-1b3525a0f044","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-fbb91c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-fbb91c/rate-test-model-fbb91c\",\"requestedSubscription\":\"e2e-rate-iso-a-581023\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-08T21:48:50Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"12198ac7-69e3-4e57-a21b-1b3525a0f044","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-fbb91c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-fbb91c","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-581023","namespace":"ai-tenant-e2e-shared-a-fbb91c","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-08T21:48:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"12198ac7-69e3-4e57-a21b-1b3525a0f044","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-08T21:48:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"12198ac7-69e3-4e57-a21b-1b3525a0f044","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T21:48:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"12198ac7-69e3-4e57-a21b-1b3525a0f044","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T21:48:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"12198ac7-69e3-4e57-a21b-1b3525a0f044","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T21:48:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"12198ac7-69e3-4e57-a21b-1b3525a0f044","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-fbb91c/rate-test-model-fbb91c\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T21:48:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"12198ac7-69e3-4e57-a21b-1b3525a0f044","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-08T21:48:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"12198ac7-69e3-4e57-a21b-1b3525a0f044","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-581023"}
{"level":"debug","ts":"2026-07-08T21:48:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"12198ac7-69e3-4e57-a21b-1b3525a0f044","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-08T21:48:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"12198ac7-69e3-4e57-a21b-1b3525a0f044","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"8df301e8-4f76-48ae-b1c8-146c1d3ddb49","keyName":"e2e-rate-a-581023","selected_subscription":"e2e-rate-iso-a-581023","selected_subscription_key":"ai-tenant-e2e-shared-a-fbb91c/e2e-rate-iso-a-581023@ai-tenant-e2e-shared-a-fbb91c/rate-test-model-fbb91c","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-fbb91c","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-581023","namespace":"ai-tenant-e2e-shared-a-fbb91c","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-08T21:48:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"12198ac7-69e3-4e57-a21b-1b3525a0f044","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-08T21:48:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"12198ac7-69e3-4e57-a21b-1b3525a0f044","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-08T21:48:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1baf064e-eb5b-47a5-90b2-cc1a5b4288f1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:37816","PortSpecifier":{"PortValue":37816}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1baf064e-eb5b-47a5-90b2-cc1a5b4288f1","method":"POST","path":"/ai-tenant-e2e-shared-a-fbb91c/rate-test-model-fbb91c/v1/completions","host":"e2e-shared-a-fbb91c.apps.28969351-50a3-4a4b-8c99-c3afd5ef9186.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-08T21:48:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1baf064e-eb5b-47a5-90b2-cc1a5b4288f1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:37816","PortSpecifier":{"PortValue":37816}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783547331,"nanos":723608583},"http":{"id":"1baf064e-eb5b-47a5-90b2-cc1a5b4288f1","method":"POST","headers":{":authority":"e2e-shared-a-fbb91c.apps.28969351-50a3-4a4b-8c99-c3afd5ef9186.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-fbb91c/rate-test-model-fbb91c/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-08T21:48:51Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1baf064e-eb5b-47a5-90b2-cc1a5b4288f1","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1R0DMlRLQ8TKbzTOU_RJxMEakgR9SQeHql3WTpIOm92KouLZHLMKw2vWzyjWN"}
{"level":"debug","ts":"2026-07-08T21:48:51Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1baf064e-eb5b-47a5-90b2-cc1a5b4288f1","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-fbb91c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1R0DMlRLQ8TKbzTOU_RJxMEakgR9SQeHql3WTpIOm92KouLZHLMKw2vWzyjWN\"}"}
{"level":"debug","ts":"2026-07-08T21:48:51Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1baf064e-eb5b-47a5-90b2-cc1a5b4288f1","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-fbb91c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"8df301e8-4f76-48ae-b1c8-146c1d3ddb49","keyName":"e2e-rate-a-581023","subscription":"e2e-rate-iso-a-581023","tenant":"e2e-shared-a-fbb91c","userId":"8df301e8-4f76-48ae-b1c8-146c1d3ddb49","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-08T21:48:51Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1baf064e-eb5b-47a5-90b2-cc1a5b4288f1","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-fbb91c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-fbb91c/rate-test-model-fbb91c\",\"requestedSubscription\":\"e2e-rate-iso-a-581023\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-08T21:48:51Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1baf064e-eb5b-47a5-90b2-cc1a5b4288f1","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-fbb91c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-fbb91c","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-581023","namespace":"ai-tenant-e2e-shared-a-fbb91c","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-08T21:48:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1baf064e-eb5b-47a5-90b2-cc1a5b4288f1","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-08T21:48:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1baf064e-eb5b-47a5-90b2-cc1a5b4288f1","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T21:48:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1baf064e-eb5b-47a5-90b2-cc1a5b4288f1","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T21:48:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1baf064e-eb5b-47a5-90b2-cc1a5b4288f1","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T21:48:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1baf064e-eb5b-47a5-90b2-cc1a5b4288f1","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-fbb91c/rate-test-model-fbb91c\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T21:48:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1baf064e-eb5b-47a5-90b2-cc1a5b4288f1","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-08T21:48:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1baf064e-eb5b-47a5-90b2-cc1a5b4288f1","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-581023"}
{"level":"debug","ts":"2026-07-08T21:48:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1baf064e-eb5b-47a5-90b2-cc1a5b4288f1","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-08T21:48:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1baf064e-eb5b-47a5-90b2-cc1a5b4288f1","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"8df301e8-4f76-48ae-b1c8-146c1d3ddb49","keyName":"e2e-rate-a-581023","selected_subscription":"e2e-rate-iso-a-581023","selected_subscription_key":"ai-tenant-e2e-shared-a-fbb91c/e2e-rate-iso-a-581023@ai-tenant-e2e-shared-a-fbb91c/rate-test-model-fbb91c","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-fbb91c","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-581023","namespace":"ai-tenant-e2e-shared-a-fbb91c","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-08T21:48:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1baf064e-eb5b-47a5-90b2-cc1a5b4288f1","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-08T21:48:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1baf064e-eb5b-47a5-90b2-cc1a5b4288f1","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-08T21:49:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4005ef96-d160-4b79-808e-fa9373f702f7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:49266","PortSpecifier":{"PortValue":49266}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"4005ef96-d160-4b79-808e-fa9373f702f7","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-fbb91c.apps.28969351-50a3-4a4b-8c99-c3afd5ef9186.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-08T21:49:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4005ef96-d160-4b79-808e-fa9373f702f7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:49266","PortSpecifier":{"PortValue":49266}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783547349,"nanos":947651904},"http":{"id":"4005ef96-d160-4b79-808e-fa9373f702f7","method":"POST","headers":{":authority":"e2e-shared-a-fbb91c.apps.28969351-50a3-4a4b-8c99-c3afd5ef9186.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-08T21:49:09Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"4005ef96-d160-4b79-808e-fa9373f702f7","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-08T21:49:09Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"4005ef96-d160-4b79-808e-fa9373f702f7","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"e150623e-58ce-4428-b91c-a74051e277ae","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=7198852e-234f-44f5-a80d-330ce4ef59ba"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/c3afd5ef9186"]}}
{"level":"debug","ts":"2026-07-08T21:49:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"4005ef96-d160-4b79-808e-fa9373f702f7","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/c3afd5ef9186"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=7198852e-234f-44f5-a80d-330ce4ef59ba"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"e150623e-58ce-4428-b91c-a74051e277ae","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"74f990853dc8a280afcc78b4bda00bb6954e86e746eecac2bbb04478e4b65ae3"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.52:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-fbb91c.apps.28969351-50a3-4a4b-8c99-c3afd5ef9186.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-08T21:49:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4005ef96-d160-4b79-808e-fa9373f702f7","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T21:49:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4005ef96-d160-4b79-808e-fa9373f702f7","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T21:49:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4005ef96-d160-4b79-808e-fa9373f702f7","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-fbb91c/rate-test-model-fbb91c\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T21:49:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"4005ef96-d160-4b79-808e-fa9373f702f7","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-08T21:49:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4005ef96-d160-4b79-808e-fa9373f702f7","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-08T21:49:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4005ef96-d160-4b79-808e-fa9373f702f7","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-08T21:49:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4005ef96-d160-4b79-808e-fa9373f702f7","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-08T21:49:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4005ef96-d160-4b79-808e-fa9373f702f7","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-08T21:49:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ade7397e-d2ca-46cf-89eb-cfe39717db0c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:51014","PortSpecifier":{"PortValue":51014}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ade7397e-d2ca-46cf-89eb-cfe39717db0c","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-6edaf8.apps.28969351-50a3-4a4b-8c99-c3afd5ef9186.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-08T21:49:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ade7397e-d2ca-46cf-89eb-cfe39717db0c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:51014","PortSpecifier":{"PortValue":51014}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783547349,"nanos":983871925},"http":{"id":"ade7397e-d2ca-46cf-89eb-cfe39717db0c","method":"POST","headers":{":authority":"e2e-shared-b-6edaf8.apps.28969351-50a3-4a4b-8c99-c3afd5ef9186.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-08T21:49:09Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"ade7397e-d2ca-46cf-89eb-cfe39717db0c","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-08T21:49:09Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ade7397e-d2ca-46cf-89eb-cfe39717db0c","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"e150623e-58ce-4428-b91c-a74051e277ae","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=7198852e-234f-44f5-a80d-330ce4ef59ba"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/c3afd5ef9186"]}}
{"level":"debug","ts":"2026-07-08T21:49:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ade7397e-d2ca-46cf-89eb-cfe39717db0c","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/c3afd5ef9186"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=7198852e-234f-44f5-a80d-330ce4ef59ba"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"e150623e-58ce-4428-b91c-a74051e277ae","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"75f96ff5e489bdca0150c4c75717a6fe8fd4c16a613ddfa524a8da7c70ca0f53"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.54:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-6edaf8.apps.28969351-50a3-4a4b-8c99-c3afd5ef9186.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-08T21:49:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ade7397e-d2ca-46cf-89eb-cfe39717db0c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T21:49:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ade7397e-d2ca-46cf-89eb-cfe39717db0c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T21:49:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ade7397e-d2ca-46cf-89eb-cfe39717db0c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-6edaf8/rate-test-model-6edaf8\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T21:49:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"ade7397e-d2ca-46cf-89eb-cfe39717db0c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-08T21:49:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ade7397e-d2ca-46cf-89eb-cfe39717db0c","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-08T21:49:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ade7397e-d2ca-46cf-89eb-cfe39717db0c","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-08T21:49:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ade7397e-d2ca-46cf-89eb-cfe39717db0c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-08T21:49:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ade7397e-d2ca-46cf-89eb-cfe39717db0c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-08T21:49:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4ad70d68-69f9-40ff-863d-5670f4c5cb20","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:49276","PortSpecifier":{"PortValue":49276}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"4ad70d68-69f9-40ff-863d-5670f4c5cb20","method":"POST","path":"/ai-tenant-e2e-shared-a-fbb91c/rate-test-model-fbb91c/v1/completions","host":"e2e-shared-a-fbb91c.apps.28969351-50a3-4a4b-8c99-c3afd5ef9186.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-08T21:49:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4ad70d68-69f9-40ff-863d-5670f4c5cb20","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:49276","PortSpecifier":{"PortValue":49276}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783547350,"nanos":23631128},"http":{"id":"4ad70d68-69f9-40ff-863d-5670f4c5cb20","method":"POST","headers":{":authority":"e2e-shared-a-fbb91c.apps.28969351-50a3-4a4b-8c99-c3afd5ef9186.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-fbb91c/rate-test-model-fbb91c/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-08T21:49:10Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"4ad70d68-69f9-40ff-863d-5670f4c5cb20","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-ZsfdV2vfzZ6ANcma_iyts0aE9MIjFCrL0qpWajsaYpS2FFHYVFiiJXAEs0cL"}
{"level":"debug","ts":"2026-07-08T21:49:10Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"4ad70d68-69f9-40ff-863d-5670f4c5cb20","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-fbb91c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-ZsfdV2vfzZ6ANcma_iyts0aE9MIjFCrL0qpWajsaYpS2FFHYVFiiJXAEs0cL\"}"}
{"level":"debug","ts":"2026-07-08T21:49:10Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"4ad70d68-69f9-40ff-863d-5670f4c5cb20","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-fbb91c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"59bdae34-547e-4dd5-b539-a2516c15e005","keyName":"e2e-rate-a-d2c61e","subscription":"e2e-rate-iso-a-d2c61e","tenant":"e2e-shared-a-fbb91c","userId":"59bdae34-547e-4dd5-b539-a2516c15e005","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-08T21:49:10Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"4ad70d68-69f9-40ff-863d-5670f4c5cb20","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-fbb91c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-fbb91c/rate-test-model-fbb91c\",\"requestedSubscription\":\"e2e-rate-iso-a-d2c61e\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-08T21:49:10Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"4ad70d68-69f9-40ff-863d-5670f4c5cb20","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-fbb91c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-fbb91c","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d2c61e","namespace":"ai-tenant-e2e-shared-a-fbb91c","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-08T21:49:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"4ad70d68-69f9-40ff-863d-5670f4c5cb20","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-08T21:49:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4ad70d68-69f9-40ff-863d-5670f4c5cb20","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T21:49:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4ad70d68-69f9-40ff-863d-5670f4c5cb20","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T21:49:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4ad70d68-69f9-40ff-863d-5670f4c5cb20","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T21:49:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4ad70d68-69f9-40ff-863d-5670f4c5cb20","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-fbb91c/rate-test-model-fbb91c\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T21:49:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4ad70d68-69f9-40ff-863d-5670f4c5cb20","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-08T21:49:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4ad70d68-69f9-40ff-863d-5670f4c5cb20","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-d2c61e"}
{"level":"debug","ts":"2026-07-08T21:49:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4ad70d68-69f9-40ff-863d-5670f4c5cb20","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-08T21:49:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4ad70d68-69f9-40ff-863d-5670f4c5cb20","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"59bdae34-547e-4dd5-b539-a2516c15e005","keyName":"e2e-rate-a-d2c61e","selected_subscription":"e2e-rate-iso-a-d2c61e","selected_subscription_key":"ai-tenant-e2e-shared-a-fbb91c/e2e-rate-iso-a-d2c61e@ai-tenant-e2e-shared-a-fbb91c/rate-test-model-fbb91c","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-fbb91c","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d2c61e","namespace":"ai-tenant-e2e-shared-a-fbb91c","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-08T21:49:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4ad70d68-69f9-40ff-863d-5670f4c5cb20","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-08T21:49:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4ad70d68-69f9-40ff-863d-5670f4c5cb20","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-08T21:49:11Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5befccbf-70cd-4bba-8f1f-5e01d9346c0e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:35200","PortSpecifier":{"PortValue":35200}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5befccbf-70cd-4bba-8f1f-5e01d9346c0e","method":"POST","path":"/ai-tenant-e2e-shared-a-fbb91c/rate-test-model-fbb91c/v1/completions","host":"e2e-shared-a-fbb91c.apps.28969351-50a3-4a4b-8c99-c3afd5ef9186.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-08T21:49:11Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5befccbf-70cd-4bba-8f1f-5e01d9346c0e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:35200","PortSpecifier":{"PortValue":35200}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783547351,"nanos":63862587},"http":{"id":"5befccbf-70cd-4bba-8f1f-5e01d9346c0e","method":"POST","headers":{":authority":"e2e-shared-a-fbb91c.apps.28969351-50a3-4a4b-8c99-c3afd5ef9186.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-fbb91c/rate-test-model-fbb91c/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-08T21:49:11Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5befccbf-70cd-4bba-8f1f-5e01d9346c0e","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-ZsfdV2vfzZ6ANcma_iyts0aE9MIjFCrL0qpWajsaYpS2FFHYVFiiJXAEs0cL"}
{"level":"debug","ts":"2026-07-08T21:49:11Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5befccbf-70cd-4bba-8f1f-5e01d9346c0e","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-fbb91c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-ZsfdV2vfzZ6ANcma_iyts0aE9MIjFCrL0qpWajsaYpS2FFHYVFiiJXAEs0cL\"}"}
{"level":"debug","ts":"2026-07-08T21:49:11Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5befccbf-70cd-4bba-8f1f-5e01d9346c0e","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-fbb91c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"59bdae34-547e-4dd5-b539-a2516c15e005","keyName":"e2e-rate-a-d2c61e","subscription":"e2e-rate-iso-a-d2c61e","tenant":"e2e-shared-a-fbb91c","userId":"59bdae34-547e-4dd5-b539-a2516c15e005","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-08T21:49:11Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5befccbf-70cd-4bba-8f1f-5e01d9346c0e","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-fbb91c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-fbb91c/rate-test-model-fbb91c\",\"requestedSubscription\":\"e2e-rate-iso-a-d2c61e\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-08T21:49:11Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5befccbf-70cd-4bba-8f1f-5e01d9346c0e","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-fbb91c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-fbb91c","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d2c61e","namespace":"ai-tenant-e2e-shared-a-fbb91c","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-08T21:49:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5befccbf-70cd-4bba-8f1f-5e01d9346c0e","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-08T21:49:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5befccbf-70cd-4bba-8f1f-5e01d9346c0e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T21:49:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5befccbf-70cd-4bba-8f1f-5e01d9346c0e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T21:49:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5befccbf-70cd-4bba-8f1f-5e01d9346c0e","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T21:49:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5befccbf-70cd-4bba-8f1f-5e01d9346c0e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-fbb91c/rate-test-model-fbb91c\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T21:49:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5befccbf-70cd-4bba-8f1f-5e01d9346c0e","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-08T21:49:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5befccbf-70cd-4bba-8f1f-5e01d9346c0e","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-08T21:49:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5befccbf-70cd-4bba-8f1f-5e01d9346c0e","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-d2c61e"}
{"level":"debug","ts":"2026-07-08T21:49:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5befccbf-70cd-4bba-8f1f-5e01d9346c0e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"59bdae34-547e-4dd5-b539-a2516c15e005","keyName":"e2e-rate-a-d2c61e","selected_subscription":"e2e-rate-iso-a-d2c61e","selected_subscription_key":"ai-tenant-e2e-shared-a-fbb91c/e2e-rate-iso-a-d2c61e@ai-tenant-e2e-shared-a-fbb91c/rate-test-model-fbb91c","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-fbb91c","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d2c61e","namespace":"ai-tenant-e2e-shared-a-fbb91c","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-08T21:49:11Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5befccbf-70cd-4bba-8f1f-5e01d9346c0e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-08T21:49:11Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5befccbf-70cd-4bba-8f1f-5e01d9346c0e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-08T21:49:12Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5f760ff9-c78e-4080-93a7-07084b4d964f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:35208","PortSpecifier":{"PortValue":35208}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5f760ff9-c78e-4080-93a7-07084b4d964f","method":"POST","path":"/ai-tenant-e2e-shared-a-fbb91c/rate-test-model-fbb91c/v1/completions","host":"e2e-shared-a-fbb91c.apps.28969351-50a3-4a4b-8c99-c3afd5ef9186.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-08T21:49:12Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5f760ff9-c78e-4080-93a7-07084b4d964f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:35208","PortSpecifier":{"PortValue":35208}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783547352,"nanos":102914055},"http":{"id":"5f760ff9-c78e-4080-93a7-07084b4d964f","method":"POST","headers":{":authority":"e2e-shared-a-fbb91c.apps.28969351-50a3-4a4b-8c99-c3afd5ef9186.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-fbb91c/rate-test-model-fbb91c/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-08T21:49:12Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5f760ff9-c78e-4080-93a7-07084b4d964f","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-ZsfdV2vfzZ6ANcma_iyts0aE9MIjFCrL0qpWajsaYpS2FFHYVFiiJXAEs0cL"}
{"level":"debug","ts":"2026-07-08T21:49:12Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5f760ff9-c78e-4080-93a7-07084b4d964f","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-fbb91c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-ZsfdV2vfzZ6ANcma_iyts0aE9MIjFCrL0qpWajsaYpS2FFHYVFiiJXAEs0cL\"}"}
{"level":"debug","ts":"2026-07-08T21:49:12Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5f760ff9-c78e-4080-93a7-07084b4d964f","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-fbb91c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"59bdae34-547e-4dd5-b539-a2516c15e005","keyName":"e2e-rate-a-d2c61e","subscription":"e2e-rate-iso-a-d2c61e","tenant":"e2e-shared-a-fbb91c","userId":"59bdae34-547e-4dd5-b539-a2516c15e005","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-08T21:49:12Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5f760ff9-c78e-4080-93a7-07084b4d964f","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-fbb91c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-fbb91c/rate-test-model-fbb91c\",\"requestedSubscription\":\"e2e-rate-iso-a-d2c61e\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-08T21:49:12Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5f760ff9-c78e-4080-93a7-07084b4d964f","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-fbb91c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-fbb91c","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d2c61e","namespace":"ai-tenant-e2e-shared-a-fbb91c","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-08T21:49:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5f760ff9-c78e-4080-93a7-07084b4d964f","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-08T21:49:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5f760ff9-c78e-4080-93a7-07084b4d964f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T21:49:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5f760ff9-c78e-4080-93a7-07084b4d964f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T21:49:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5f760ff9-c78e-4080-93a7-07084b4d964f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-fbb91c/rate-test-model-fbb91c\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T21:49:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5f760ff9-c78e-4080-93a7-07084b4d964f","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T21:49:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5f760ff9-c78e-4080-93a7-07084b4d964f","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-08T21:49:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5f760ff9-c78e-4080-93a7-07084b4d964f","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-d2c61e"}
{"level":"debug","ts":"2026-07-08T21:49:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5f760ff9-c78e-4080-93a7-07084b4d964f","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-08T21:49:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5f760ff9-c78e-4080-93a7-07084b4d964f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"59bdae34-547e-4dd5-b539-a2516c15e005","keyName":"e2e-rate-a-d2c61e","selected_subscription":"e2e-rate-iso-a-d2c61e","selected_subscription_key":"ai-tenant-e2e-shared-a-fbb91c/e2e-rate-iso-a-d2c61e@ai-tenant-e2e-shared-a-fbb91c/rate-test-model-fbb91c","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-fbb91c","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d2c61e","namespace":"ai-tenant-e2e-shared-a-fbb91c","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-08T21:49:12Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5f760ff9-c78e-4080-93a7-07084b4d964f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-08T21:49:12Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5f760ff9-c78e-4080-93a7-07084b4d964f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-08T21:49:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d34f8005-bc5c-4d12-806d-263fcfb865e4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:35210","PortSpecifier":{"PortValue":35210}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d34f8005-bc5c-4d12-806d-263fcfb865e4","method":"POST","path":"/ai-tenant-e2e-shared-a-fbb91c/rate-test-model-fbb91c/v1/completions","host":"e2e-shared-a-fbb91c.apps.28969351-50a3-4a4b-8c99-c3afd5ef9186.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-08T21:49:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d34f8005-bc5c-4d12-806d-263fcfb865e4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:35210","PortSpecifier":{"PortValue":35210}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783547353,"nanos":143025205},"http":{"id":"d34f8005-bc5c-4d12-806d-263fcfb865e4","method":"POST","headers":{":authority":"e2e-shared-a-fbb91c.apps.28969351-50a3-4a4b-8c99-c3afd5ef9186.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-fbb91c/rate-test-model-fbb91c/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-08T21:49:13Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d34f8005-bc5c-4d12-806d-263fcfb865e4","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-ZsfdV2vfzZ6ANcma_iyts0aE9MIjFCrL0qpWajsaYpS2FFHYVFiiJXAEs0cL"}
{"level":"debug","ts":"2026-07-08T21:49:13Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d34f8005-bc5c-4d12-806d-263fcfb865e4","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-fbb91c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-ZsfdV2vfzZ6ANcma_iyts0aE9MIjFCrL0qpWajsaYpS2FFHYVFiiJXAEs0cL\"}"}
{"level":"debug","ts":"2026-07-08T21:49:13Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d34f8005-bc5c-4d12-806d-263fcfb865e4","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-fbb91c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"59bdae34-547e-4dd5-b539-a2516c15e005","keyName":"e2e-rate-a-d2c61e","subscription":"e2e-rate-iso-a-d2c61e","tenant":"e2e-shared-a-fbb91c","userId":"59bdae34-547e-4dd5-b539-a2516c15e005","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-08T21:49:13Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d34f8005-bc5c-4d12-806d-263fcfb865e4","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-fbb91c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-fbb91c/rate-test-model-fbb91c\",\"requestedSubscription\":\"e2e-rate-iso-a-d2c61e\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-08T21:49:13Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d34f8005-bc5c-4d12-806d-263fcfb865e4","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-fbb91c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-fbb91c","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d2c61e","namespace":"ai-tenant-e2e-shared-a-fbb91c","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-08T21:49:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d34f8005-bc5c-4d12-806d-263fcfb865e4","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-08T21:49:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d34f8005-bc5c-4d12-806d-263fcfb865e4","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T21:49:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d34f8005-bc5c-4d12-806d-263fcfb865e4","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T21:49:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d34f8005-bc5c-4d12-806d-263fcfb865e4","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-fbb91c/rate-test-model-fbb91c\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T21:49:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d34f8005-bc5c-4d12-806d-263fcfb865e4","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T21:49:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d34f8005-bc5c-4d12-806d-263fcfb865e4","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-08T21:49:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d34f8005-bc5c-4d12-806d-263fcfb865e4","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-d2c61e"}
{"level":"debug","ts":"2026-07-08T21:49:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d34f8005-bc5c-4d12-806d-263fcfb865e4","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-08T21:49:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d34f8005-bc5c-4d12-806d-263fcfb865e4","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"59bdae34-547e-4dd5-b539-a2516c15e005","keyName":"e2e-rate-a-d2c61e","selected_subscription":"e2e-rate-iso-a-d2c61e","selected_subscription_key":"ai-tenant-e2e-shared-a-fbb91c/e2e-rate-iso-a-d2c61e@ai-tenant-e2e-shared-a-fbb91c/rate-test-model-fbb91c","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-fbb91c","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d2c61e","namespace":"ai-tenant-e2e-shared-a-fbb91c","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-08T21:49:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d34f8005-bc5c-4d12-806d-263fcfb865e4","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-08T21:49:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d34f8005-bc5c-4d12-806d-263fcfb865e4","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-08T21:49:14Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"df81663f-d2bb-4b51-99d2-d2e5d13fbba7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:35224","PortSpecifier":{"PortValue":35224}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"df81663f-d2bb-4b51-99d2-d2e5d13fbba7","method":"POST","path":"/ai-tenant-e2e-shared-a-fbb91c/rate-test-model-fbb91c/v1/completions","host":"e2e-shared-a-fbb91c.apps.28969351-50a3-4a4b-8c99-c3afd5ef9186.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-08T21:49:14Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"df81663f-d2bb-4b51-99d2-d2e5d13fbba7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:35224","PortSpecifier":{"PortValue":35224}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783547354,"nanos":187808657},"http":{"id":"df81663f-d2bb-4b51-99d2-d2e5d13fbba7","method":"POST","headers":{":authority":"e2e-shared-a-fbb91c.apps.28969351-50a3-4a4b-8c99-c3afd5ef9186.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-fbb91c/rate-test-model-fbb91c/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-08T21:49:14Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"df81663f-d2bb-4b51-99d2-d2e5d13fbba7","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-ZsfdV2vfzZ6ANcma_iyts0aE9MIjFCrL0qpWajsaYpS2FFHYVFiiJXAEs0cL"}
{"level":"debug","ts":"2026-07-08T21:49:14Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"df81663f-d2bb-4b51-99d2-d2e5d13fbba7","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-fbb91c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-ZsfdV2vfzZ6ANcma_iyts0aE9MIjFCrL0qpWajsaYpS2FFHYVFiiJXAEs0cL\"}"}
{"level":"debug","ts":"2026-07-08T21:49:14Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"df81663f-d2bb-4b51-99d2-d2e5d13fbba7","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-fbb91c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"59bdae34-547e-4dd5-b539-a2516c15e005","keyName":"e2e-rate-a-d2c61e","subscription":"e2e-rate-iso-a-d2c61e","tenant":"e2e-shared-a-fbb91c","userId":"59bdae34-547e-4dd5-b539-a2516c15e005","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-08T21:49:14Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"df81663f-d2bb-4b51-99d2-d2e5d13fbba7","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-fbb91c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-fbb91c/rate-test-model-fbb91c\",\"requestedSubscription\":\"e2e-rate-iso-a-d2c61e\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-08T21:49:14Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"df81663f-d2bb-4b51-99d2-d2e5d13fbba7","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-fbb91c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-fbb91c","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d2c61e","namespace":"ai-tenant-e2e-shared-a-fbb91c","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-08T21:49:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"df81663f-d2bb-4b51-99d2-d2e5d13fbba7","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-08T21:49:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"df81663f-d2bb-4b51-99d2-d2e5d13fbba7","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T21:49:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"df81663f-d2bb-4b51-99d2-d2e5d13fbba7","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T21:49:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"df81663f-d2bb-4b51-99d2-d2e5d13fbba7","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-fbb91c/rate-test-model-fbb91c\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T21:49:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"df81663f-d2bb-4b51-99d2-d2e5d13fbba7","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T21:49:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"df81663f-d2bb-4b51-99d2-d2e5d13fbba7","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-d2c61e"}
{"level":"debug","ts":"2026-07-08T21:49:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"df81663f-d2bb-4b51-99d2-d2e5d13fbba7","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-08T21:49:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"df81663f-d2bb-4b51-99d2-d2e5d13fbba7","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-08T21:49:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"df81663f-d2bb-4b51-99d2-d2e5d13fbba7","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"59bdae34-547e-4dd5-b539-a2516c15e005","keyName":"e2e-rate-a-d2c61e","selected_subscription":"e2e-rate-iso-a-d2c61e","selected_subscription_key":"ai-tenant-e2e-shared-a-fbb91c/e2e-rate-iso-a-d2c61e@ai-tenant-e2e-shared-a-fbb91c/rate-test-model-fbb91c","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-fbb91c","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d2c61e","namespace":"ai-tenant-e2e-shared-a-fbb91c","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-08T21:49:14Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"df81663f-d2bb-4b51-99d2-d2e5d13fbba7","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-08T21:49:14Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"df81663f-d2bb-4b51-99d2-d2e5d13fbba7","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-08T21:49:15Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"65ed0767-d145-4392-a1d6-6b4acd6c6db3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:35226","PortSpecifier":{"PortValue":35226}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"65ed0767-d145-4392-a1d6-6b4acd6c6db3","method":"POST","path":"/ai-tenant-e2e-shared-a-fbb91c/rate-test-model-fbb91c/v1/completions","host":"e2e-shared-a-fbb91c.apps.28969351-50a3-4a4b-8c99-c3afd5ef9186.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-08T21:49:15Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"65ed0767-d145-4392-a1d6-6b4acd6c6db3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:35226","PortSpecifier":{"PortValue":35226}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783547355,"nanos":222834311},"http":{"id":"65ed0767-d145-4392-a1d6-6b4acd6c6db3","method":"POST","headers":{":authority":"e2e-shared-a-fbb91c.apps.28969351-50a3-4a4b-8c99-c3afd5ef9186.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-fbb91c/rate-test-model-fbb91c/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-08T21:49:15Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"65ed0767-d145-4392-a1d6-6b4acd6c6db3","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-ZsfdV2vfzZ6ANcma_iyts0aE9MIjFCrL0qpWajsaYpS2FFHYVFiiJXAEs0cL"}
{"level":"debug","ts":"2026-07-08T21:49:15Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"65ed0767-d145-4392-a1d6-6b4acd6c6db3","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-fbb91c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-ZsfdV2vfzZ6ANcma_iyts0aE9MIjFCrL0qpWajsaYpS2FFHYVFiiJXAEs0cL\"}"}
{"level":"debug","ts":"2026-07-08T21:49:15Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"65ed0767-d145-4392-a1d6-6b4acd6c6db3","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-fbb91c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"59bdae34-547e-4dd5-b539-a2516c15e005","keyName":"e2e-rate-a-d2c61e","subscription":"e2e-rate-iso-a-d2c61e","tenant":"e2e-shared-a-fbb91c","userId":"59bdae34-547e-4dd5-b539-a2516c15e005","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-08T21:49:15Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"65ed0767-d145-4392-a1d6-6b4acd6c6db3","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-fbb91c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-fbb91c/rate-test-model-fbb91c\",\"requestedSubscription\":\"e2e-rate-iso-a-d2c61e\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-08T21:49:15Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"65ed0767-d145-4392-a1d6-6b4acd6c6db3","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-fbb91c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-fbb91c","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d2c61e","namespace":"ai-tenant-e2e-shared-a-fbb91c","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-08T21:49:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"65ed0767-d145-4392-a1d6-6b4acd6c6db3","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-08T21:49:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"65ed0767-d145-4392-a1d6-6b4acd6c6db3","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T21:49:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"65ed0767-d145-4392-a1d6-6b4acd6c6db3","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T21:49:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"65ed0767-d145-4392-a1d6-6b4acd6c6db3","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T21:49:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"65ed0767-d145-4392-a1d6-6b4acd6c6db3","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-fbb91c/rate-test-model-fbb91c\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T21:49:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"65ed0767-d145-4392-a1d6-6b4acd6c6db3","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-08T21:49:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"65ed0767-d145-4392-a1d6-6b4acd6c6db3","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-08T21:49:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"65ed0767-d145-4392-a1d6-6b4acd6c6db3","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-d2c61e"}
{"level":"debug","ts":"2026-07-08T21:49:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"65ed0767-d145-4392-a1d6-6b4acd6c6db3","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"59bdae34-547e-4dd5-b539-a2516c15e005","keyName":"e2e-rate-a-d2c61e","selected_subscription":"e2e-rate-iso-a-d2c61e","selected_subscription_key":"ai-tenant-e2e-shared-a-fbb91c/e2e-rate-iso-a-d2c61e@ai-tenant-e2e-shared-a-fbb91c/rate-test-model-fbb91c","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-fbb91c","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d2c61e","namespace":"ai-tenant-e2e-shared-a-fbb91c","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-08T21:49:15Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"65ed0767-d145-4392-a1d6-6b4acd6c6db3","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-08T21:49:15Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"65ed0767-d145-4392-a1d6-6b4acd6c6db3","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-08T21:49:16Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c61119ff-2709-439e-a300-f69b767c2fee","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:35240","PortSpecifier":{"PortValue":35240}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c61119ff-2709-439e-a300-f69b767c2fee","method":"POST","path":"/ai-tenant-e2e-shared-a-fbb91c/rate-test-model-fbb91c/v1/completions","host":"e2e-shared-a-fbb91c.apps.28969351-50a3-4a4b-8c99-c3afd5ef9186.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-08T21:49:16Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c61119ff-2709-439e-a300-f69b767c2fee","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:35240","PortSpecifier":{"PortValue":35240}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783547356,"nanos":259833278},"http":{"id":"c61119ff-2709-439e-a300-f69b767c2fee","method":"POST","headers":{":authority":"e2e-shared-a-fbb91c.apps.28969351-50a3-4a4b-8c99-c3afd5ef9186.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-fbb91c/rate-test-model-fbb91c/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-08T21:49:16Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"c61119ff-2709-439e-a300-f69b767c2fee","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-ZsfdV2vfzZ6ANcma_iyts0aE9MIjFCrL0qpWajsaYpS2FFHYVFiiJXAEs0cL"}
{"level":"debug","ts":"2026-07-08T21:49:16Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c61119ff-2709-439e-a300-f69b767c2fee","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-fbb91c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-ZsfdV2vfzZ6ANcma_iyts0aE9MIjFCrL0qpWajsaYpS2FFHYVFiiJXAEs0cL\"}"}
{"level":"debug","ts":"2026-07-08T21:49:16Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c61119ff-2709-439e-a300-f69b767c2fee","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-fbb91c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"59bdae34-547e-4dd5-b539-a2516c15e005","keyName":"e2e-rate-a-d2c61e","subscription":"e2e-rate-iso-a-d2c61e","tenant":"e2e-shared-a-fbb91c","userId":"59bdae34-547e-4dd5-b539-a2516c15e005","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-08T21:49:16Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c61119ff-2709-439e-a300-f69b767c2fee","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-fbb91c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-fbb91c/rate-test-model-fbb91c\",\"requestedSubscription\":\"e2e-rate-iso-a-d2c61e\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-08T21:49:16Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c61119ff-2709-439e-a300-f69b767c2fee","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-fbb91c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-fbb91c","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d2c61e","namespace":"ai-tenant-e2e-shared-a-fbb91c","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-08T21:49:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"c61119ff-2709-439e-a300-f69b767c2fee","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-08T21:49:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c61119ff-2709-439e-a300-f69b767c2fee","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T21:49:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c61119ff-2709-439e-a300-f69b767c2fee","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T21:49:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c61119ff-2709-439e-a300-f69b767c2fee","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T21:49:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c61119ff-2709-439e-a300-f69b767c2fee","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-fbb91c/rate-test-model-fbb91c\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T21:49:16Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c61119ff-2709-439e-a300-f69b767c2fee","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-d2c61e"}
{"level":"debug","ts":"2026-07-08T21:49:16Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c61119ff-2709-439e-a300-f69b767c2fee","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-08T21:49:16Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c61119ff-2709-439e-a300-f69b767c2fee","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-08T21:49:16Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c61119ff-2709-439e-a300-f69b767c2fee","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"59bdae34-547e-4dd5-b539-a2516c15e005","keyName":"e2e-rate-a-d2c61e","selected_subscription":"e2e-rate-iso-a-d2c61e","selected_subscription_key":"ai-tenant-e2e-shared-a-fbb91c/e2e-rate-iso-a-d2c61e@ai-tenant-e2e-shared-a-fbb91c/rate-test-model-fbb91c","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-fbb91c","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d2c61e","namespace":"ai-tenant-e2e-shared-a-fbb91c","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-08T21:49:16Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c61119ff-2709-439e-a300-f69b767c2fee","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-08T21:49:16Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c61119ff-2709-439e-a300-f69b767c2fee","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-08T21:49:16Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8098e93b-1f6f-4ca6-aae9-f39af43d08ee","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:39982","PortSpecifier":{"PortValue":39982}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"8098e93b-1f6f-4ca6-aae9-f39af43d08ee","method":"POST","path":"/ai-tenant-e2e-shared-b-6edaf8/rate-test-model-6edaf8/v1/completions","host":"e2e-shared-b-6edaf8.apps.28969351-50a3-4a4b-8c99-c3afd5ef9186.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-08T21:49:16Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8098e93b-1f6f-4ca6-aae9-f39af43d08ee","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:39982","PortSpecifier":{"PortValue":39982}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783547356,"nanos":294166308},"http":{"id":"8098e93b-1f6f-4ca6-aae9-f39af43d08ee","method":"POST","headers":{":authority":"e2e-shared-b-6edaf8.apps.28969351-50a3-4a4b-8c99-c3afd5ef9186.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-6edaf8/rate-test-model-6edaf8/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-08T21:49:16Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"8098e93b-1f6f-4ca6-aae9-f39af43d08ee","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1dlHlGGz0fGrjbA4o_dotqWNvVcidHgwHyhYQ5NoR2QS44b1YcO3mhXyjlSQ8"}
{"level":"debug","ts":"2026-07-08T21:49:16Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"8098e93b-1f6f-4ca6-aae9-f39af43d08ee","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-6edaf8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1dlHlGGz0fGrjbA4o_dotqWNvVcidHgwHyhYQ5NoR2QS44b1YcO3mhXyjlSQ8\"}"}
{"level":"debug","ts":"2026-07-08T21:49:16Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"8098e93b-1f6f-4ca6-aae9-f39af43d08ee","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-6edaf8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"adc371bd-a394-4290-a4d7-fb144daa3c40","keyName":"e2e-rate-b-d2c61e","subscription":"e2e-rate-iso-b-d2c61e","tenant":"e2e-shared-b-6edaf8","userId":"adc371bd-a394-4290-a4d7-fb144daa3c40","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-08T21:49:16Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"8098e93b-1f6f-4ca6-aae9-f39af43d08ee","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-6edaf8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-6edaf8/rate-test-model-6edaf8\",\"requestedSubscription\":\"e2e-rate-iso-b-d2c61e\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-08T21:49:16Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"8098e93b-1f6f-4ca6-aae9-f39af43d08ee","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-6edaf8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-6edaf8","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-d2c61e","namespace":"ai-tenant-e2e-shared-b-6edaf8","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-08T21:49:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"8098e93b-1f6f-4ca6-aae9-f39af43d08ee","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-08T21:49:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8098e93b-1f6f-4ca6-aae9-f39af43d08ee","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T21:49:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8098e93b-1f6f-4ca6-aae9-f39af43d08ee","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T21:49:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8098e93b-1f6f-4ca6-aae9-f39af43d08ee","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T21:49:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8098e93b-1f6f-4ca6-aae9-f39af43d08ee","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-6edaf8/rate-test-model-6edaf8\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T21:49:16Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8098e93b-1f6f-4ca6-aae9-f39af43d08ee","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-08T21:49:16Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8098e93b-1f6f-4ca6-aae9-f39af43d08ee","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-08T21:49:16Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8098e93b-1f6f-4ca6-aae9-f39af43d08ee","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-d2c61e"}
{"level":"debug","ts":"2026-07-08T21:49:16Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8098e93b-1f6f-4ca6-aae9-f39af43d08ee","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"adc371bd-a394-4290-a4d7-fb144daa3c40","keyName":"e2e-rate-b-d2c61e","selected_subscription":"e2e-rate-iso-b-d2c61e","selected_subscription_key":"ai-tenant-e2e-shared-b-6edaf8/e2e-rate-iso-b-d2c61e@ai-tenant-e2e-shared-b-6edaf8/rate-test-model-6edaf8","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-6edaf8","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-d2c61e","namespace":"ai-tenant-e2e-shared-b-6edaf8","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-08T21:49:16Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8098e93b-1f6f-4ca6-aae9-f39af43d08ee","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-08T21:49:16Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8098e93b-1f6f-4ca6-aae9-f39af43d08ee","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-08T21:49:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/28bf2da0dfa3cf38dd67bc20ea0f0128dae7b178e6ceeaf8c61ee4ae9a379d9b"}
{"level":"info","ts":"2026-07-08T21:49:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/29d8e05e17bf2aa52311ba9f2aa2b8f708ea0a3a214bd3afc91ee27b4cbbb4ce"}
{"level":"info","ts":"2026-07-08T21:49:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/0745863b456447e558a4a53ee4add4485fa8ff437454caa8e33542e7a59a9a72"}
{"level":"info","ts":"2026-07-08T21:49:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/0f55d82994fba5e63a0ce11c062f22c55f990b39c302e51b48b2ce098647f297"}
{"level":"info","ts":"2026-07-08T21:49:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/fb3ee0616b923606ea609c87234346b85d41cbbb7db3809e14f4c561c6542bbd"}
{"level":"info","ts":"2026-07-08T21:49:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b129d5e6efbc7625e8756cf278870a82fa832d7456bea97fc3519b283490bdce"}
{"level":"info","ts":"2026-07-08T21:49:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/0e2113ac80d7650582a092eca892a76a0216af28256ba5a93dbe5e8e060356d9"}
{"level":"info","ts":"2026-07-08T21:49:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/601fa04d111a25234a8148e51d6d734fb7c307e259718911efe3e1705a809f98"}
{"level":"info","ts":"2026-07-08T21:49:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3566755a74bdf005c22036058ecb149b4921d09fd85759462e1e5bb04495887e"}
{"level":"info","ts":"2026-07-08T21:49:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1ca1694823f5deda8e00acee784a19bc752890c3b80e577192c6444e2b353fd7"}
{"level":"info","ts":"2026-07-08T21:49:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/677abf60d9019db2f024f7d302325636f91831a983506e03e8dd3255eff9c427"}
{"level":"info","ts":"2026-07-08T21:49:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/cd3683d92f223e9e9c945cb1d4303f74bbf05a57822c225d08cb0cac9c7dfae1"}
{"level":"info","ts":"2026-07-08T21:49:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/63900473334735a68ffa3164fef3b6a2368e3d36ca04361533f1f52f385d1d8c"}
{"level":"info","ts":"2026-07-08T21:49:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9e6ed0b779b4e60c924bb81dba908ed945d89646ab3f5d68720479bed1bf0c4d"}
{"level":"info","ts":"2026-07-08T21:49:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/407bd59a62ce77cec81f4a4d17a9a1e36300cd7f093fc62470d14e255ce17718"}
{"level":"info","ts":"2026-07-08T21:49:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c26f474283304837eeac69681b91dccbf8c7415e4c587eaf20dee19ffac27b5b"}
{"level":"info","ts":"2026-07-08T21:50:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9b43e0e1075c6422f6320fbb27346fa374aaca552536d337f7b697e2dc1c7b2b"}
{"level":"info","ts":"2026-07-08T21:50:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/74f990853dc8a280afcc78b4bda00bb6954e86e746eecac2bbb04478e4b65ae3"}
{"level":"info","ts":"2026-07-08T21:50:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/80a90b8e76d0ecb65ccc8b90421f826ebb06e42b00c2506645e850f9a1695e68"}
{"level":"info","ts":"2026-07-08T21:50:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b38353481c388254a93bb2d85ca21ef7d2625b5783885841f70964ed2e16c209"}
{"level":"info","ts":"2026-07-08T21:50:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3c80761d470cba66be83dd79aebc6da99105be485f578e77b7d309591637371d"}
{"level":"info","ts":"2026-07-08T21:50:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/dd08ee968d5b6b4ba9721913819e630146179e1d9e5f3b7a4dffd6c2fc1c1574"}
{"level":"info","ts":"2026-07-08T21:50:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/75f96ff5e489bdca0150c4c75717a6fe8fd4c16a613ddfa524a8da7c70ca0f53"}
{"level":"info","ts":"2026-07-08T21:50:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f2d1d29da451966389403278ffce45dc232693e39f4042eb27a8cc19dca79574"}